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A  strong  central  management  office 
and  greater  top  management  involve¬ 
ment  will  be  necessary  if  Agriculture 
is  to  provide  the  leadership  and  direc¬ 
tion  that  is  needed  for  its  growing 
investment  in  computer  and  informa¬ 
tion  resources. 

The  Department  must  also  better  plan 
for  its  information  resources  activi¬ 
ties.  Its  computer  centers  must  be  run 
more  efficiently,  and  its  control  of 
and  accountability  for  software  devel¬ 
opment  must  be  tightened.  Finally, 
the  Department  must  place  a  higher 
priority  on  the  security  of  its  infor¬ 
mation  resources. 

The  senior  official  appointed  under 
the  Paperwork  Reduction  Act  of  1980 
should  develop  an  information  re¬ 
sources  management  program  for  the 
Department  and  its  agencies  which 
would  be  responsive  to  GAO's  recom¬ 
mendations  for  improvement. 
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The  Honorable  Jack  Brooks 
Chairman,  Committee  on 
Government  Operations 
House  of  Representatives 

Dear  Mr.  Chairman: 


Pursuant  to  your  request,  we  have  reviewed  the  effectiveness 
of  the  Department  of  Agriculture's  computer  and  information  re¬ 
sources.  The  review  includes  an  evaluation  of  the  Department's 
automatic  data  processing  organization  and  structure,  management 
functions,  and  security  activities. 

This  report  identifies  problems  the  Department  of  Agricul¬ 
ture  is  experiencing  in  managing  and  using  its  computer  and 
information  resources.  We  believe  that  the  Paperwork  Reduction 
Act  of  1980,  if  effectively  implemented  by  the  Department,  will 
foster  the  improvements  in  information  resources  management  that 
this  and  other  reports  show  is  so  badly  needed. 

Based  on  your  wishes,  we  did  not  obtain  written  agency 
comments  or  discuss  our  conclusions  and  recommendations  with 
agency  officials  except  those  dealing  with  implementation  of  the 
Paperwork  Reduction  Act.  This  discussion,  cleared  through  your 
office,  was  necessary  so  that  we  could  present  our  views  to  USDA 
officials  before  the  senior  official  was  designated.  Department 
officials  acknowledged  our  recommendations  but  said  they  had 
only  begun  to  study  the  implications  of  the  act  and,  therefore, 
could  not  respond  at  this  time. 


As  arranged  with  your  office,  we  will  not  make  distribution 
of  this  report  until  30  days  from  this  date.  At  that  time,  we 
will  send  it  to  interested  parties  and  make  copies  available  to 
others  upon  request. 
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Sincerely  yours, 


Acting  Comptroller  General 
of  the  United  States 


DEPARTMENT  OF  AGRICULTURE 
NEEDS  LEADERSHIP  IN  MANAGING 
ITS  INFORMATION  RESOURCES 


COMPTROLLER  GENERAL'S 
REPORT  TO  THE  CHAIRMAN 
COMMITTEE  ON 
GOVERNMENT  OPERATIONS 
HOUSE  OF  REPRESENTATIVES 


DIGEST 

The  U.S.  Department  of  Agriculture  (USDA)  needs 
to  better  manage  its  computer  and  information 
resources  if  it  is  to  meet  the  demands  of  its 
users.  Restructuring  its  ADP  organization  un¬ 
der  a  senior  official  with  strengthened 
authority  is  a  must  if  USDA  is  to  deal  with 
the  many  information  resources  problems  it 
faces . 

USDA's  program  effectiveness  largely  depends 
on  computers  and  related  information  resources. 
Information  technology  helps  its  agencies 
provide  the  public  with  more,  better,  and 
faster  service  at  a  lower  cost  and  with  fewer 
people. 

STRONG  MANAGEMENT  IS  NEEDED 

For  several  years  problems  have  been  identified 
in  USDA's  management  and  use  of  information  re¬ 
sources.  Yet,  little  has  been  done  to  solve 
these  problems.  The  current  central  automatic 
data  processing  (ADP)  office  acts  more  as 
a  coordinator  and  advisory  office  than  as 
the  manager  of  critical  information  resources. 
It  does  not  have  the  required  authority  to 
ensure  effective  and  efficient  management 
and  use  of  information  resources.  It  also  has 
no  authority  over  agency  in-house  development 
efforts  and  has  not  developed  an  oversight 
mechanism  to  ensure  that  agencies  are  comply¬ 
ing  with  its  security  regulations. 

In  passing  the  Paperwork  Reduction  Act  of  1980, 
the  Congress  mandated  that  each  agency  appoint 
a  single  senior  official  with  authority  and 
responsibility  for  ensuring  effective  and  effi¬ 
cient  information  resources  management.  This 
official  must  report  to  the  agency  head.  If 
effectively  implemented,  the  act  should 
materially  improve  USDA's  information  resources 
management.  (See  ch.  2.) 
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In  April  1981  the  Secretary  named  his  Executive 
Assistant  as  USDA's  senior  official.  No  other 
action  had  been  taken  to  implement  the  act  be¬ 
cause  USDA  needed  more  time  to  study  its 
implications. 

GAO  recommends  that  the  Secretary  of  Agriculture 

— establish  a  separate  central  information 
resources  management  office  headed  by  the 
senior  official; 

—  include  as  part  of  the  new  office  such 
information-related  subcomponents  as  are 
deemed  necessary  for  the  senior  official 
to  carry  out  his  responsibilities; 

— direct  the  senior  official  to  develop  and  im¬ 
plement  an  information  resources  management 
program  for  the  Department  and  its  agencies; 

— establish  a  top-level  USDA  steering 
committee  or  similar  group  of  agency 
representatives  to  provide  the  senior 
official  with  advice  and  recommendations 
on  policy  and  other  significant  informa¬ 
tion  resources  management  matters;  and 

— direct  agencies  and  offices  to  establish 
central  information  management  units 
subject  to  the  review  and  approval  of  the 
senior  official. 

(See  pp.  27  and  28  for  additional  recommenda¬ 
tions.  ) 

MORE  GUIDANCE  AND  CONTROL  WILL 
IMPROVE  SOFTWARE  DEVELOPMENT 

Development,  conversion,  and  maintenance  of 
applications  software  is  not  effective 
because  management  practices  generally  accept¬ 
ed  in  the  information  systems  profession  are 
not  followed.  Agencies  frequently  do  not 
prepare  requirements  analyses,  cost/benefit 
studies,  or  comprehensive  project  plans. 

Nor  are  full-time  project  managers  with 
authority,  responsibility,  and  accountability 
always  assigned  to  software  projects. 

These  poor  management  practices  have 
contributed  to  time  and  cost  overruns 
on  software  development  projects. 


The  National  Finance  Center's  payroll  redesign 
project  will  be  completed  3-1/2  years  be¬ 
hind  schedule.  Farmers  Home  Administration's 
Unified  Management  Information  System  could 
cost  $42  million  to  complete  as  designed — an 
overrun  of  $25  million.  USDA  has  been  study¬ 
ing  Farmers  Home  Administration's  system 
alternatives  for  ways  to  correct  its  management 
and  technical  problems.  The  total  development 
costs  for  an  alternative  system  may  range  from 
$27.5  million  to  $42  million.  Delays  in  com¬ 
pleting  software  projects  are  causing  newly 
installed  modern  equipment  to  be  underused 
while  the  use  of  obsolete  computers  continues. 
Also,  software  maintenance  activities  are 
poorly  managed.  (See  ch.  3.) 

GAO  recommends  that  the  Secretary  of 
Agriculture  provide  the  senior  official  with 
clear  responsibility  and  authority  over  soft¬ 
ware.  With  this  mandate  from  the  Secretary, 
the  senior  official  should 

— establish  formal  procedures  and  policies 
to  control  major  software  projects 
to  ensure  that  accepted  ADP  management 
practices  are  being  used  and 

— establish  a  technical  assistance  center  for 
computer  software  and  systems  development. 

(See  p.  46  for  additional  recommendations.) 

USDA  COMPUTER  CENTERS 

MUST  BE  RUN  MORE  EFFICIENTLY 

Users  of  four  USDA  computer  centers  have 
expressed  their  dissatisfaction  with  avail¬ 
ability,  accessibility,  and  response  times. 

In  dealing  with  capacity  problems,  the  cen¬ 
ters  have  looked  to  more  equipment  as  the 
solution.  Unnecessary  demands  on  available 
computer  resources  could  be  reduced  by  more 
efficient  practices  such  as  reviewing  applica¬ 
tions  for  ways  to  improve  performance.  The 
centers'  problems  are  aggravated  by  serious 
delays  in  converting  software  applications 
from  old  equipment  to  new  computers.  As  a  re¬ 
sult,  obsolete  equipment  is  being  used  instead 
of  newer,  more  efficient  computers. 

(See  ch.  4.) 

GAO  recommends  that  the  Secretary  of 
Agriculture  direct  the  senior  official  to 
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establish  a  computer  performance  management 
program  including  objectives  for  user  service 
levels;  uniform  reporting  on  performance, 
capacity,  and  utilization;  and  standard 
operating  procedures  related  to  efficient 
use  of  computer  center  resources. 

(See  p.  60  for  additional  recommendations. ) 

ADP  SECURITY  NEEDS  A  HIGHER  PRIORITY 


USDA  agencies  have  placed  too  little  emphasis 
on  ADP  security.  Controls  to  prevent  unauth¬ 
orized  access  to  computer  files  are  weak. 
Physical  controls  over  equipment  and  buildings 
need  improvement.  Inadequate  security  planning 
for  continuing  processing  in  the  event  of  a 
disaster  increases  USDA's  vulnerability  to 
loss.  (See  ch.  5. ) 

USDA  should  strengthen  its  ADP  security 
program.  GAO  recommends  that  the  Secretary 
of  Agriculture  direct  the  senior  official  to 

— vest  USDA  security  officers  with  sufficient 
authority  to  enforce  ADP  security  regulations 
and 

—  include,  as  part  of  his  periodic  reviews 

of  information  management  activities  required 
by  the  Paperwork  Reduction  Act,  evaluations 
of  agencies'  compliance  with  USDA  security 
regulations. 

A  COMPREHENSIVE  PLANNING 
PROCESS  IS  NEEDED 


USDA  has  not  established  a  comprehensive  plan¬ 
ning  process — a  recognized  keystone  for  effec¬ 
tive  ADP  management.  Such  a  process  requires 
an  organization  to  define  its  goals  in  relation 
to  mission  requirements,  set  priorities  for 
achieving  these  goals,  and  measure  the  results 
through  a  systematic  feedback  process. 

Lack  of  emphasis  on  comprehensive  planning  has 
resulted  in  inefficient  and  ineffective  use 
of  information  resources  that  has  contributed  to 
cost  overruns  of  millions  of  dollars  for  six 
large  software  projects.  (See  ch.  3.)  In  addi¬ 
tion,  deficient  planning  has  contributed  to  (1) 
continual  problems  in  maintaining  sufficient  capac¬ 
ity  at  computer  centers  to  provide  consistent. 
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quality  service  and  (2)  increasing  vulnerability 
to  extended  processing  interruptions  in  the 
event  of  a  disaster.  (See  ch.  6.) 

GAO  recommends  that  the  Secretary  of  Agricul¬ 
ture  direct  the  senior  official  to 

— develop  guidelines  for  a  comprehensive, 
long-range  planning  process  for  managing 
information  resources  and 

— direct  the  agencies  to  adapt  their  planning 
process  to  guidelines  developed  by  the  senior 
official. 

AGENCY  COMMENTS 

In  line  with  the  House  Government  Operations 
Committee's  wishes,  GAO  did  not  obtain  com¬ 
ments  on  this  report  or  discuss  with  USDA 
officials  the  conclusions  and  recommendations, 
except  those  dealing  with  implementation  of 
the  Paperwork  Reduction  Act.  With  the  con¬ 
currence  of  the  committee's  office,  GAO  did 
discuss  its  proposed  recommendations  for  im¬ 
plementing  the  act  with  USDA  officials  in 
March  and  April  1981  because  it  was  important 
that  GAO  present  its  views  before  the  senior 
official  was  designated.  The  USDA  officials 
acknowledged  GAO's  recommendations  but  said 
they  had  only  begun  to  study  the  implications 
of  the  act  on  USDA  and,  therefore,  could  not 
respond  at  this  time. 
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CHAPTER  1 


INTRODUCTION 

In  response  to  a  letter  from  the  Chairman,  House  Committee 
on  Government  Operations,  we  have  reviewed  the  U.S.  Department 
of  Agriculture's  (USDA's)  central  automatic  data  processing 
(ADP)  management  and  organizational  structure.  The  chairman 
requested  the  review  because  he  was  concerned  that 

—  the  Secretary  of  Agriculture's  October  1977  reorganization 
had  weakened  USDA's  central  ADP  management  office  by  com¬ 
bining  ADP  with  financial,  procurement,  and  other  adminis¬ 
trative  functions; 

— the  Farmers  Home  Administration  (FmHA)  was  continuing  to 
have  significant  problems  developing  its  large-scale 
Unified  Management  Information  System  (UMIS); 

— serious  deficiencies  prevailed  in  USDA's  ADP  management 
and  operations  as  disclosed  in  the  large  number  of  reports 
issued  since  1975  by  us  and  the  USDA  Office  of  Inspector 
General  (see  apps.  I  and  II);  and 

— the  deficiencies  existing  at  USDA's  National  Finance 
Center  (NFC)  were  symptomatic  of  weak  central  ADP 
management . 

Problems  such  as  these,  which  exist  throughout  the  Government, 
were  instrumental  in  the  passage  of  the  Paperwork  Reduction  Act 
of  1980  (Public  Law  96-511),  enacted  on  December  11,  1980.  One 
objective  of  the  act  was  to  strengthen  Federal  information  manage¬ 
ment  activities. 

The  chairman  also  requested  that  we  begin  our  work  by  inves¬ 
tigating  the  need  for  NFC  to  noncompetitively  procure  an  interim 
computer .  The  chairman  asked  for  a  quick  response  on  the  results 
of  our  work  because  NFC  stressed  its  urgent  need  for  this 
acquisition.  Therefore,  we  provided  an  oral  briefing  to  the 
committee  staff  on  October  12,  1979.  We  told  them  that  management 
deficiencies  associated  with  missed  completion  dates  of  critical 
NFC  ADP  software  projects  (the  payroll/personnel  system  redesign 
and  the  conversion  of  software  from  old  to  new  equipment)  had 
resulted  in  (1)  additional  costs  to  retain  old  computers,  (2) 
costs  to  acquire  additional  computer  equipment  or  capacity,  and 
(3)  delayed  benefits  to  users.  We  concurred  with  NFC's  plans  to 
acquire  an  old,  surplus  computer  solely  for  backup  during  the 
redesign  period  instead  of  a  newer,  more  expensive  computer. 
Subsequently,  NFC  procured  the  surplus  computer  on  an  interim 
basis . 
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CONGRESSIONAL  CONCERN  ABOUT 
USDA's  ADP  MANAGEMENT 


The  House  Government  Operations  Committee  has  been  concerned 
about  the  ADP  management  structure  in  place  at  USDA  and  other 
Federal  agencies.  The  committee's  position  is  that  a  strong 
management  structure  is  critical  to  an  agency  or  department 
successfully  applying  ADP  and  other  information  technology  to 
the  support  of  Government  programs.  The  committee's  concern  is 
evident  from  its  letters  to  the  Secretary  of  Agriculture  and  other 
agency  heads,  from  its  recent  investigations  of  FmHA's  UMIS  proj¬ 
ect  and  the  Air  Force's  phase  IV  program,  and  from  its  efforts 
to  promote  passage  of  the  Paperwork  Reduction  Act  of  1980. 

The  committee's  report  on  FmHA's  UMIS  project  1/  expressed 
the  following  concerns  with  the  ADP  structure  in  USDA: 

"The  inability  of  the  Department's  central  ADP 
management  office  to  take  early  and  effective  action 
to  correct  the  deficiencies  of  the  UMIS  project, 
raises  serious  doubts  about  this  office  having  suffi¬ 
cient  authority  to  exercise  its  responsibilities." 

The  chairman  sent  letters  to  various  agency  heads  stressing 
the  importance  of  a  strong  ADP  management  structure.  In  a  March 
1980  letter,  he  stated  that  the  need  for  stronger  management  of 
agencies'  ADP  resources  is  the  major  issue  which  his  committee 
has  been  focusing  its  attention  on  for  the  past  several  years. 

In  another  instance,  because  his  committee  viewed  USDA's  1977 
reorganization  as  diluting  the  central  ADP  management  authority 
within  the  Department,  the  chairman  sent  a  letter  on  March  21, 
1978,  to  the  Secretary  of  Agriculture  expressing  this  concern. 

But  perhaps  the  best  indication  of  the  committee's  interest 
in  the  structure  of  ADP  management  for  Federal  agencies  is  the 
Paperwork  Reduction  Act  of  1980.  The  committee  issued  its 
report  2/  on  the  bill,  H.R.  6410,  on  March  19,  1980.  The  bill 
was  introduced  by  the  chairman  and  other  members  of  the  House 
Government  Operations  Committee.  In  its  report  the  committee 
stated. 


1/" Management  Failures  in  Developing  the  Farmers  Home 

Administration's  Unified  Management  Information  System," 
House  Report  No.  96-1403,  September  26,  1980. 


2/House  Report  No. 


96-835  (96th  Cong., 


2d  session.  Mar.  19,  1980). 
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"This  legislation  is  the  result  of  the  committee's 
oversight  of  several  of  the  agencies  affected  by 
H.R.  6410.  The  committee  has  held  a  number  of 
hearings  relating  to  the  need  for  a  strong  manage¬ 
ment  structure  for  information  resources." 

The  act  creates  a  new  management  structure  for  the 
Government's  information  activities,  including  ADP.  First, 
within  the  Office  of  Management  and  Budget  a  central  office 
is  established  with  broad  responsibilities  for  developing  con¬ 
sistent  information  policies  and  overseeing  agency  activities. 
Second,  within  each  agency  a  senior-level  official  is  to  be 
designated  who  will  be  held  accountable  for  ensuring  that  the 
agency  effectively  carries  out  its  information  management 
activities. 

Congressional  committees  and  individual  congressmen  have 
also  expressed  concern  about  other  aspects  of  USDA's  ADP  manage¬ 
ment.  These  concerns  have  dealt  with  physical  and  data  security, 
large-scale  software  development  projects,  and  noncompetitive 
computer  procurements.  Most  of  the  reports  listed  in  appendix  I 
were  our  response  to  these  concerns. 

USDA  RELIES  ON  ADP  TECHNOLOGY 
TO  MEET  PROGRAM  REQUIREMENTS 


USDA  has  responsibility  for  several  broad  missions  encom¬ 
passing  over  300  separate  programs  that  are  managed  by  USDA 
agencies  and  offices.  (See  chart  on  p.  4. )  These  programs 
include  home  loans  to  farmers,  rural  development,  commodity 
price  support  loans,  conservation,  nutrition,  food  assistance, 
agricultural  research  and  education,  and  national  forest  man¬ 
agement.  The  goal  of  ADP  management  at  USDA  is  to  develop  ef¬ 
fective  and  efficient  data  processing  systems  and  applications 
to  help  carry  out  these  programs  and  provide  quality  service 
to  the  American  people. 

USDA's  program  effectiveness  largely  depends  on  computers, 
telecommunications,  and  related  information  resources.  The 
organizational  structure  established  to  manage  these  resources 
consists  of  a  central  office  and  the  individual  structures  set 
up  at  each  of  the  agencies.  1/  The  central  ADP  office  is  the 
Office  of  Data  Services,  which  is  part  of  the  Office  of  Opera¬ 
tions  and  Finance  under  the  Assistant  Secretary  for  Administra¬ 
tion.  (See  chart  on  p.  5. )  At  USDA,  responsibility  for  ADP 
management  is  shared  by  the  central  office  and  the  agencies. 


1/hs  used  in  this  report,  the  term  "agency"  includes  designated 
agencies  and  other  staff  offices. 
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To  keep  up  with  their  expanding  responsibilities,  USDA  man¬ 
agers,  scientists,  analysts,  and  other  personnel  are  relying  more 
on  ADP  and  telecommunications  technology.  Computers  help  them  to 
provide  more,  better,  and  faster  service;  do  things  which  could 
not  be  done  without  computers;  and  provide  services  at  less  cost 
or  with  fewer  people.  Budget  data  shows  that  ADP  and  telecommun¬ 
ications  obligations  have  almost  doubled  in  USDA  since  1977  when 
obligations  were  about  $81.5  million.  Estimated  obligations  for 
fiscal  year  1981  are  $158  million. 

ADP  and  telecommunications  technology  are  critical  resources 
for  NFC,  the  Forest  Service,  the  Agricultural  Stabilization  and 
Conservation  Service  (ASCS)  and  FmHA — four  of  USDA's  largest  ADP 
users. 

National  Finance  Center 


NFC  is  USDA's  central  administrative  processing  facility. 

Formed  in  1973  through  the  merger  of  the  departmental  payroll  and 
administrative  payments  centers,  NFC  is  now  part  of  the  Office  of 
Operations  and  Finance.  NFC's  mission  is 

"*  *  *  to  accomplish  the  Department's  automated  per¬ 
sonnel,  fiscal,  accounting  and  payroll  functions 
and  to  provide  all  levels  of  management  with  timely 
and  accurate  information  for  the  management  of 
financial  and  human  resources." 

These  processes  are  heavily  automated,  making  NFC  a  major  user  of 
computer  support.  Of  NFC's  $27.7  million  total  fiscal  year  1980 
budget,  we  estimated  that  ADP  accounted  for  about  $10.8  million, 
or  39  percent. 

NFC  processes  bills  for  payments,  computes  employee  payrolls, 
collects  debts,  and  generates  personnel  and  accounting  information 
for  USDA  agencies  and  staff  offices.  In  fiscal  year  1980,  NFC 
processed  more  than  11.7  million  transactions  resulting  in  a  payroll 
of  $2.3  billion,  about  $1.7  billion  in  other  payments,  and  $134 
million  in  collections. 

To  make  these  tasks  feasible,  NFC  has  developed  a  number 
of  computer  programs  which  fall  into  three  categories;  the  par¬ 
tially  operational  central  accounting  system,  which  will  ulti¬ 
mately  perform  most  accounting  functions  for  USDA  agencies;  the 
administrative  payments  and  collections  systems,  which  process 
documents  related  to  agency  expenditures  and  debts  owed  to  the 
Government;  and  the  payroll  and  personnel  reporting  system, 
which  computes  the  $90  million  biweekly  payroll  and  provides 
various  personnel  management  reports. 
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Forest  Service 


The  Forest  Service  uses  ADP  technology  as  an  integral  part 
of  its  activities.  Increased  demands  for  renewable  resources, 
for  the  protection  of  resources,  and  for  management  information 
require  extensive  use  of  ADP  and  supporting  technology.  The 
Forest  Service  is  rapidly  expanding  its  use  of  ADP  services. 

ADP  obligations  have  grown  from  $5.2  million  in  1970  to  a 
forecasted  $82.6  million  in  1981. 

Land  management  planning,  as  mandated  by  recent  legislation, 
will  have  a  great  impact  on  data  processing.  The  Forest  and 
Rangeland  Renewable  Resources  Planning  Act  of  1974  as  amended 
by  the  National  Forest  Management  Act  of  1976  (16  U.S.C.  1600 
et  seq . )  expanded  Forest  Service  planning  responsibilities  and 
ADP  needs.  The  Resources  Planning  Act  requires  that  the  Forest 
Service  assess  the  Nation's  forest,  range,  and  other  associated 
lands'  renewable  resources  program  every  5  years.  The  National 
Forest  Management  Act  requires  the  Forest  Service  to  develop 
a  land  and  resource  management  plan  for  each  of  its  forests 
before  1985.  ADP  will  be  required  to  handle  the  large  amounts 
of  information  necessary  to  create  the  plans. 

Data  processing  is  also  used  in  areas  such  as  inventories, 
road  design,  and  financial  accounting.  Planning,  budgeting,  and 
administrative  activities  also  use  computer  applications  to  pro¬ 
vide  management  data  as  well  as  external  reports.  Word  process¬ 
ing  and  electronic  mail  will  also  increasingly  require  ADP 
resources . 

Agricultural  Stabilization  and  Conservation  Service 

ASCS  is  interrelated  with  the  Commodity  Credit  Corporation, 
a  wholly  Government-owned  corporation  which  has  no  operating 
personnel  of  its  own.  The  Commodity  Credit  Corporation's  activ¬ 
ities  are  conducted  by  ASCS  personnel  working  through  ASCS 
facilities.  State  and  county  committees,  and  other  USDA  agencies. 

The  Commodity  Credit  Corporation  was  created  in  1933  to 
stabilize,  support,  and  protect  farm  incomes  and  prices;  to  help 
maintain  balanced  and  adequate  supplies  of  agricultural  commodities 
and  to  facilitate  the  orderly  distribution  of  such  commodities. 

Its  programs  and  activities  range  from  feed,  grain,  wheat,  and 
cotton  programs  to  commodity  support  and  marketing  quota  programs. 

To  support  the  above  programs,  ASCS  has  developed  several 
ADP  application  systems.  For  example,  the  price  support  loan 
system  was  developed  to  record  information  on  loans  made,  storage 
payments,  repayments,  and  forfeitures.  Another  system  is  the 
processed  commodity  inventory  system,  which  is  designed  to  maintain 
records  of  acquisitions  and  dispositions  of  processed  commodities. 
Estimated  ASCS  obligations  for  ADP  totaled  about  $12  million  for 
fiscal  year  1980. 
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Farmers  Home  Administration 


FmHA  has  grown  from  a  credit  agency  for  low-income  farmers 
to  a  major  Federal  agency  providing  assistance  for  agricultural 
and  rural  development.  In  1979  FmHA  was  servicing  the  accounts 
of  about  1.25  million  individual  and  association  borrowers  with 
a  principal  indebtedness  of  $36  billion. 

FmHA *  s  current  computer-based  accounting  and  information 
system  processes  loan  accounting  data  for  programs  serving  rural 
Americans.  Because  of  serious  deficiencies  in  this  system,  FmHA 
decided  in  1974  to  begin  developing  a  replacement  system,  UMIS, 
to  provide  better  management  information.  To  date  FmHA  has 
incurred  about  $17  million  in  costs  to  develop  UMIS.  In  chapter 
3  we  discuss  FmHA's  problems  in  trying  to  develop  a  viable 
information  system. 

CENTRAL  COMPUTER  AND  TELECOMMUNICATIONS  RESOURCES 


Data  Services,  USDA's  central  ADP  office,  operates  four 
major  computer  centers.  These  are  the  Fort  Collins  Computer 
Center  in  Colorado,  the  Kansas  City  Computer  Center  and  the 
St.  Louis  Computer  Center  in  Missouri,  and  the  Washington  Com¬ 
puter  Center  in  Washington,  D.C.  St.  Louis  is  organizationally 
under  the  management  control  of  the  Kansas  City  Director .  For 
the  last  few  years.  Data  Services  has  been  planning  to  close 
the  St.  Louis  center  and  move  its  operations  to  Kansas  City. 

This  move  was  planned  to  occur  when  FmHA's  UMIS  project  was 
completed.  However,  because  of  delays  in  completing  the  project, 
the  status  of  the  St.  Louis  facility  is  uncertain. 

Before  1978  Data  Services  also  operated  the  computer 
center  at  NFC  in  New  Orleans,  Louisiana.  During  the  USDA-wide 
reorganization  in  1977,  NFC  took  control  of  this  computer 
center  and  merged  it  into  its  operations. 

Together,  these  centers  serve  all  USDA  agencies.  Annual 
operating  costs  are  about  $20  million.  These  costs  are  charged 
back  to  the  agencies  through  a  billing  mechanism  based  on  the 
amount  and  type  of  service  rendered. 

In  addition  to  its  computers,  USDA  has  a  sizable  invest¬ 
ment  in  data  communications  networks.  Data  Services  and 
various  agencies  operate  six  different  communications  networks 
having  equipment  valued  by  USDA  at  about  $1.9  million  and 
incurring  annual  operating  costs  of  $4.5  million.  USDA  also 
employs  approximately  1,500  data  terminals  dispersed  nationwide 
which  operate  over  dial  circuits. 

OBJECTIVE,  SCOPE,  AND  METHODOLOGY 

Our  review  was  made  pursuant  to  the  request  of  the  Chairman, 
House  Government  Operations  Committee.  The  objective  of  our 
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review  was  to  evaluate  the  effectiveness  of  the  Department's 
central  ADP  management  and  organizational  structure  in  support¬ 
ing  USDA's  mission  and  programs.  We  accomplished  this  objective 
by  evaluating  how  USDA's  central  management  structure  ensured 
that  major  ADP  management  functions  such  as  planning,  developing 
software,  and  maintaining  security  were  adequately  performed 
by  USDA  agencies.  We  carried  out  our  work  at  four  USDA  computer 
centers,  selected  agencies,  and  the  Department's  central  ADP 
management  office.  More  details  on  the  objective,  scope,  and 
method  of  our  review  are  presented  in  chapter  7. 


CHAPTER  2 


EFFECTIVE  IMPLEMENTATION  OF  THE  PAPERWORK 
REDUCTION  ACT  WILL  FOSTER  BETTER 
INFORMATION  RESOURCES  MANAGEMENT 

The  Department’s  central  ADP  office  has  not  been  providing 
the  planning,  control,  and  direction  necessary  to  ensure  the 
efficient  and  effective  use  of  USDA's  growing  investment  in 
computer  resources.  The  central  ADP  office  was  established 
by  the  Secretary  in  1972  to  manage  USDA's  total  ADP  resources. 
However,  since  then  this  office  has  been  weakened  by  a  major 
ADP  procurement  cancellation,  reorganization,  and  an  ambiguous 
mission.  The  central  office,  located  at  a  low  level  in  the 
organization,  has  been  relegated  to  functioning  primarily  in 
advisory,  procedural,  and  coordinating  capacities. 

The  result  of  this  weak  management  is  continuing  deficien¬ 
cies  in  the  management  and  use  of  ADP  and  other  information 
resources.  Software  projects  are  incurring  cost  and  time  over¬ 
runs  because  they  are  not  properly  managed.  The  Department 
computer  centers  have  had  continual  problems  in  releasing  obso¬ 
lete  equipment  and  in  maintaining  efficient  operations  and  ade¬ 
quate  capacity  to  meet  user  requirements.  The  central  office 
has  no  oversight  mechanism  to  ensure  agency  compliance  with 
security  standards  and  procedures.  Although  the  importance 
of  an  overall  ADP  plan  was  recognized  as  early  as  1970,  guide¬ 
lines  for  preparing  such  a  plan  do  not  yet  exist.  Under  the 
current  organizational  structure,  accountability  for  these 
deficiencies  is  unclear  and  dispersed. 

We  believe  that  the  Paperwork  Reduction  Act  of  1980,  if 
effectively  implemented,  will  materially  improve  USDA's  infor¬ 
mation  resources  management  (IRM).  The  act  requires  USDA  to 
designate  a  senior  official,  reporting  to  the  Secretary,  with 
authority  and  responsibility  for  ensuring  the  effective  and 
efficient  management  of  ADP  and  other  information  resources. 

This  senior  official  must  not  be  burdened  with  duties  unrelated 
to  IRM  and  should  be  supported  with  a  strong  organizational 
structure.  The  official  will  also  need  to  develop  an  IRM  pro¬ 
gram  for  USDA  setting  out  the  plans,  policies,  and  priorities 
whereby  the  Secretary  can  communicate  to  the  organization  the 
direction  it  should  take  in  IRM  matters.  With  a  strong  organi¬ 
zational  structure  and  an  IRM  program,  the  senior  official  can 
provide  the  necessary  planning,  control,  direction,  and  account¬ 
ability  USDA  so  badly  needs. 
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EXISTING  ADP  ORGANIZATION  DOES  NOT 
PROVIDE  ADEQUATE  PLANNING,  CONTROL, 

DIRECTION,  AND  ACCOUNTABILITY 

Established  in  1972  to  manage  all  USDA  data  processing 
resources,  the  central  ADP  office's  authority  has  been  so  weak¬ 
ened  by  a  major  ADP  procurement  cancellation,  reorganization,  and 
lack  of  a  clear  mission  that  it  now  carries  out  essentially  an 
advisory  role.  The  central  office  has  also  received  little 
direction  from  USDA  agencies'  top  management  since  no  effective 
forum  exists  for  such  direction.  Furthermore,  accountability 
for  ensuring  the  efficient  and  effective  use  of  USDA's  ADP 
resources  is  unclear  and  dispersed. 

This  absence  of  central  direction  and  control  has 
contributed  to  many  serious  deficiencies  in  how  agencies  manage 
and  use  ADP  resources.  These  deficiencies,  dealt  with  in  sub¬ 
sequent  chapters  of  this  report,  include 

— no  evaluation  or  oversight  mechanism  to  ensure  efficient 
and  effective  use  of  ADP  resources  (see  chs.  3  through  6), 

— failure  to  take  timely  corrective  action  to  deal  with 
FmHA's  problems  with  UMIS  (see  ch.  3), 

--large  cost  and  time  overruns  associated  with  software 
projects  (see  ch.  3), 

— lack  of  consistent,  quality  service  from  USDA  computer 
centers  (see  ch.  4), 

— large  amounts  of  obsolete  equipment  (see  ch.  4), 

— inefficient  use  of  computer  centers  (see  ch.  4),  and 

— lack  of  comprehensive  long-range  planning  (see  ch.  6). 

The  extensive  list  of  our  and  OIG  reports  issued  since  1975 
and  summarized  in  appendixes  I  and  II  indicate  that  USDA's  ADP 
problems  have  continued  for  some  time. 

Importance  of  central  ADP  management 
recognized  by  USDA  in  1970 

USDA's  recognition  that  it  needed  a  central  ADP  management 
office  surfaced  in  December  1970  when  a  staff  study,  prepared  to 
analyze  current  and  future  ADP  requirements,  concluded  that  USDA's 
ADP  resources  were  not  being  used  effectively.  In  particular,  the 
study  found  that  USDA's  ADP  needs  were  not  well  served  by  the 
continuing  proliferation  of  single-agency,  single-purpose  comput¬ 
ers.  The  study  identified  43  USDA  computer  systems  in  26  cities 
and  67  new  computers  planned  for  installation  by  1975.  In  most 
cases  these  computer  centers  were  managed  and  operated  by  and  for 
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individual  agencies.  The  study  recommended  that  the  Secretary  of 
Agriculture  approve  several  concepts  to  avoid  duplication  and 
waste  of  resources,  including  management  of  all  of  USDA's  data 
processing  resources  by  a  central  office. 

These  concepts  were  formally  accepted  by  the  Secretary  and 
promulgated  in  Secretary's  Memorandum  No.  1775,  dated  March  30, 
1972.  The  purpose  of  this  memorandum  was  to  strengthen  manage¬ 
ment  of  ADP  resources  by  establishing  a  central  office  to  manage 
USDA's  total  ADP  resources,  including  the  operation  of  its 
data  processing  facilities.  The  Secretary's  memorandum  established 
the  Office  of  Information  Systems  (changed  to  Office  of  Automated 
Data  Systems  in  January  1974)  as  a  separate  office  under  the 
Assistant  Secretary  for  Administration. 

Based  on  the  broad  mandate  set  out  in  the  Secretary's 
memorandum,  the  USDA  Administrative  Regulations  state  the  central 
ADP  office's  mission  as  follows: 

"Exercise  full  Department-wide  contracting  and  procure¬ 
ment  authority  for  automatic  data  processing  and  data 
transmission  equipment,  software,  services,  maintenance, 
and  related  supplies.  This  authority  includes  the  prom¬ 
ulgation  of  departmental  directives  regulating  the  manage¬ 
ment  of  contracting  and  procurement  functions  related  to 
the  above." 


***** 

"Manage  and  operate  the  total  USDA  data  processing  pro¬ 
gram  through  all  stages  of  the  data  processing  cycle: 

Advance  planning,  feasibility,  design,  equipment  selec¬ 
tion  and  acquisition  readiness  effort,  system  installa¬ 
tion,  system  impact  appraisal,  timesharing  and  service 
center  arrangements,  systems  monitoring,  evaluation, 
and  security. 

"Plan,  develop,  install,  and  manage  departmental  data 
bases  and  assist  in  the  maintenance  of  such  systems  to 
satisfy  agency  needs. 

"Develop  an  integrated  computer  network  for  use  with 
Department  agencies  and  offices." 

Major  procurement  cancellation  weakens 
confidence  in  fledgling  ADP  organization 

Shortly  after  its  formation,  the  central  ADP  office  embarked 
on  a  major  project  to  acquire  equipment  for  four  USDA  computer 
centers.  Due  to  congressional  and  our  criticism  of  the  project, 
it  was  canceled.  We  believe  that  the  fledgling  central  ADP 
office's  inability  to  carry  out  this  large-scale  ADP  procurement 
lowered  top  management's  confidence  in  the  office  and  thus 
weakened  it.  The  office  was  unable  to  recover  from  the  loss  in 
confidence  resulting  from  the  procurement's  cancellation  and 
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did  not  establish  a  strong  management  role  for  itself  within 
USDA  as  envisioned  by  the  Secretary's  1972  memorandum. 

In  April  1973  USDA  requested  authority  to  procure  ADP 
equipment  for  four  centers  (with  the  option  to  equip  a 
fifth  center).  At  that  time  the  General  Services  Adminis¬ 
tration  ( GSA )  was  planning  to  acquire  a  large-scale  computer 
system  for  one  of  its  Federal  data  processing  centers  so  that 
operations  at  its  centers  could  be  consolidated.  GSA's 
planned  procurement  involved  a  data  communications  network 
for  remote  terminal  use,  but  the  proposed  USDA  procurement 
did  not. 

Because  of  the  similarity  in  the  procurement  objectives 
of  the  two  agencies  and  because  of  the  potential  savings 
through  quantity  discounts,  USDA  proposed  a  joint  procurement. 
During  negotiations  GSA  agreed  to  use  USDA's  request  for  pro¬ 
posals  for  ADP  equipment,  and  USDA  agreed  to  use  GSA's  request 
for  proposals  for  the  data  communications  network.  In  February 
1974  GSA  released  the  request  for  proposals  for  the  joint  pro¬ 
curement  to  industry. 

This  joint  GSA  and  USDA  computer  acquisition  project  was 
referred  to  as  the  Federal  Information  Network  (FEDNET).  Our 
estimates  of  total  costs  for  USDA's  four  centers  covering  the 
project's  8-year  systems  life  came  to  $398  million,  including 
$106  million  for  ADP  equipment  and  software. 

In  April  and  May  1974  widespread  concern  was  expressed  in 
the  Congress  and  elsewhere  because  of  implications  that  FEDNET 
could  be  expanded  to  link  all  modern  computers  in  the  Govern¬ 
ment  and  could  pose  a  serious  threat  to  the  privacy  of  all 
individuals  involved  in  any  Government  operation  or  program. 

Some  Members  of  Congress  interpreted  the  joint  procurement  as 
another  attempt  to  establish  a  national  data  center,  a  concept 
the  Congress  rejected  in  1968  because  of  the  privacy  issue. 

The  Congress  was  also  critical  because  GSA  had  not  kept  it 
fully  informed  of  plans  for  a  project  as  large  as  FEDNET. 

Due  to  congressional  opposition,  the  request  for  proposal 
was  revised  in  July  1974  to  eliminate  the  data  communications 
network  and  ADP  equipment  for  the  GSA  center. 

In  response  to  congressional  requests  made  during  May  1974, 
we  reviewed  USDA's  involvement  in  the  FEDNET  project.  Our 
report  1/  concluded  that  USDA  had  not  made  the  detailed 


_1/" Improved  Planning — A  Must  Before  a  Department-wide  Automatic 
Data  Processing  System  Is  Acquired  for  the  Department  of 
Agriculture"  (LCD-75-108,  June  3,  1975). 
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plans  or  studies  that  should  have  preceded  procurement. 
Specifically,  USDA  did  not  (1)  adequately  analyze  user  require¬ 
ments,  (2)  adequately  consider  security  requirements  to  protect 
sensitive  information,  and  (3)  make  economic  studies  to  evaluate 
the  project's  benefits  and  the  costs  of  alternative  designs. 

We  recommended  that  the  proposed  procurement  be  canceled  and 
analyses  be  made  to  select  the  best  alternative  for  meeting 
USDA  requirements. 

Subsequently,  USDA  canceled  the  FEDNET  procurement.  How¬ 
ever,  rather  than  strengthening  its  management,  performing  the 
necessary  analyses,  and  developing  an  appropriate  procurement 
strategy,  the  central  ADP  office  reacted  by  developing  a  crisis 
approach  to  meeting  USDA's  immediate  data  processing  needs.  This 
approach  led  to  an  ill-conceived  plan  for  a  series  of  interim 
upgrades  (mostly  sole-source)  at  the  computer  centers.  This  ap¬ 
proach  resulted  in  congressional  concerns  about  USDA's  ADP  man¬ 
agement,  and  more  congressional  requests  for  us  to  review  USDA's 
ADP  procurements.  Our  reviews  resulted  in  a  series  of  reports 
(see  app.  I)  issued  during  1976  and  1977  disclosing  inadequate 
planning,  poor  justifications,  deficient  security,  and  an  inabil¬ 
ity  to  accurately  determine  user  requirements.  These  weaknesses 
were  similar  to  those  identified  in  the  early  1970s  by  USDA, 
during  1975  and  1976  in  our  FEDNET  review,  and  during  1980  in 
this  report.  The  result  of  years  of  weak  central  ADP  management 
is  evident  in  an  October  1980  internal  Data  Services  discussion 
paper  which  states,  "Confidence  in  ADP  solutions  is  low.  The 
automation  failures,  missed  schedules,  and  cost  overruns  have 
caused  many  program  managers  to  mistrust  ADP  project  estimates." 

Secretary's  1977  reorganization 
lowers  central  ADP  office 


On  October  5,  1977,  the  Secretary  of  Agriculture  issued  Sec¬ 
retary's  Memorandum  No.  1927  ordering  consolidations  and  mergers 
of  functions  and  units  in  seven  departmental  areas.  The  single 
criterion  given  by  the  Secretary  as  the  basis  for  his  reorgani¬ 
zation  was  that  agencies  and  offices  which  have  similar  objectives 
or  missions  should,  to  the  extent  practical,  be  consolidated.  The 
Secretary  believed  this  reorganization  would  provide  opportunities 
for  improved  management  of  departmental  programs  and  policies  by 
focusing  responsibility  for  similar  functions  in  a  similar  number 
of  units  and  administrators. 

In  his  October  1977  memorandum,  the  Secretary  directed  that 
the  three  administrative  support  offices  (Office  of  Automated 
Data  Systems,  Office  of  Operations,  and  Office  of  Finance)  under 
the  Assistant  Secretary  for  Administration  be  combined  into  a 
new  Office  of  Operations  and  Finance  (O&F).  Although  this  brought 
together  related  administrative  service  functions,  it  downgraded 
the  central  ADP  office  in  the  organizational  structure.  Rather 
than  reporting  directly  to  the  Assistant  Secretary  for  Administra¬ 
tion,  the  central  ADP  office  now  reports  to  the  Director,  O&F. 
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Later,  the  Office  of  Automated  Data  Systems  was  renamed  the 
Office  of  Data  Services.  (See  O&F  chart  on  p.  5.) 

Three  former  officials  of  the  central  ADP  office,  including 
two  officials  who  served  as  head  and  acting  head,  told  us  that 
this  merger  went  in  the  opposite  direction  of  the  prevailing  trend 
in  private  industry  which  was  to  elevate  information-related  func¬ 
tions.  They  said  more  and  more  companies  are  creating  a  "Vice- 
President  for  Information  Resources  Management."  All  three  cited 
this  USDA  reorganization  as  a  serious  setback  to  improving  ADP 
management. 

Mission  and  authority  of 
central  ADP  office  is  unclear 

Generally,  the  mandate  for  strong  central  ADP  management 
given  by  the  Secretary's  1972  memorandum  and  set  out  in  LISDA's 
Administrative  Regulations  has  not  been  widely  accepted.  The 
central  ADP  office  has  allowed  USDA  agencies  to  manage  ADP 
projects  with  minimal  departmental  involvement.  However,  on 
occasion,  the  central  office  has  taken  a  strong  stand  contrary 
to  the  wishes  of  USDA  agencies. 

The  role  currently  followed  by  the  central  ADP  office  is 
that  of  a  staff  office  which  seeks  to  carry  out  its  objectives 
through  persuasion  rather  than  any  authority  or  power  uhat  may 
be  inherent  in  its  position.  From  this  view  flows  its  reluctance 
to  "enforce"  its  thinking  on  USDA  agencies.  The  central  office 
does  not  exercise  any  regular,  formal  oversight  function  to  en¬ 
sure  adequate  ADP  management  by  agencies.  Rather,  it  sees  itself 
in  an  advisory  role  to  the  agencies  and  working  in  partnership 
with  them  in  a  cooperative  spirit  to  promote  effective  use  of 
USDA's  ADP  resources.  Finally,  the  central  office  coordinates 
rather  than  directs  the  ADP  activities  of  USDA  agencies. 

We  believe  uncertainty  about  its  mission  and  authority  is 
partly  responsible  for  the  central  ADP  office's  reluctance  to 
vigorously  carry  out  the  strong  management  role  originally 
envisioned.  Although  the  Secretary's  1972  memorandum  may  have 
provided  a  clear  mandate  when  issued,  since  then  it  has  been 
subjected  to  varying  interpretations  creating  confusion  about 
the  mission  and  authority  of  the  central  ADP  office. 

A  major  reason  for  establishing  the  central  ADP  office  was 
to  consolidate  and  operate  USDA's  large  computer  centers. 

However,  a  former  Deputy  Secretary  weakened  this  responsibility 
by  permitting  exceptions.  During  1977  requests  were  made  by 
ASCS  and  NFC  to  obtain  control  of  the  Kansas  City  and  New  Orleans 
Computer  Centers,  which  were  operated  by  the  central  ADP  office. 

In  October  1977  the  Deputy  Secretary  denied  ASCS'  request  but 
approved  NFC's.  The  Deputy  Secretary  emphasized  his  support 
for  consolidation  and  centralization  of  USDA's  computer  centers. 
However,  the  Deputy  Secretary  also  said  that  in  the  future,  if 
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any  agency  can  fully  justify  managing  its  own  computer  and  has 
submitted  a  justification  that  he  can  support,  he  will  help  that 
agency  obtain  its  own  computer. 

Changing  technology  and  new  management  concepts  have  added 
to  the  confusion.  USDA's  concern  in  the  early  1970s  was  how 
best  to  manage  USDA's  large  computer  centers  and  data  bases. 

The  need  for  centralized  operations  and  control  of  ADP  technology 
was  evident  at  that  time.  However,  since  then  important  changes 
have  been  taking  place  in  information  technology  and  management. 
Hardware  costs  have  been  falling  dramatically  while  software 
costs  have  been  increasing.  This,  along  with  advances  in  tele¬ 
communications  and  computer  hardware,  has  hastened  the  concept 
of  placing  more  computer  capability  in  the  hands  of  users  who 
may  be  located  in  field  offices  away  from  agency  headquarters. 

This  concept  is  often  referred  to  as  distributed  processing.  For 
several  years,  USDA's  central  ADP  office  was  opposed  to  this 
concept  because  it  appeared  to  conflict  with  its  mission  to  promote 
the  use  of  large,  centralized  computer  centers.  This  opposition 
created  problems  for  the  Forest  Service,  which  has  wanted  to 
implement  distributed  processing  since  at  least  1975.  It  was  only 
during  the  last  2  years  that  the  central  ADP  office  began  to  work 
in  concert  with  the  Forest  Service  on  distributing  computer 
processing  capability  to  its  field  offices. 

Although  the  new  technology  indicates  that  operations  will 
become  more  and  more  decentralized,  we  believe  it  will  require 
stronger  centralized  direction  and  control.  Only  with  strong 
centralized  management  will  an  organization  be  able  to  ensure 
that  there  is  a  solid  framework  of  plans,  policies,  standards, 
and  guidelines  to  guard  against  waste  and  inefficient  use  of 
information  technology  left  in  the  hands  of  often  inexperienced 
users. 


Finally,  in  recent  years  confusion  has  been  mounting  regard¬ 
ing  the  authority  of  USDA's  central  ADP  office  over  agency  infor¬ 
mation  activities — in  particular,  authority  over  large  management 
information  systems  under  development  by  agencies.  The  central 
ADP  office  does  not  review  or  monitor  agency  systems  development 
projects  at  specified  intervals.  It  reviews  such  projects  only 
if  they  go  over  prescribed  dollar  thresholds  and  involve  procure¬ 
ment  actions.  The  problems  created  by  the  central  ADP  office's 
unclear  authority  are  evident  in  its  inability  to  take  corrective 
action  to  help  prevent  the  failure  of  FmHA'sUMIS  project  as 
noted  in  the  House  Committee  on  Government  Operations  report 
quoted  in  chapter  1. 

Accountability  for  ADP  management 
is  dispersed 

An  important  question  that  should  be  asked  concerning  the 
ADP  deficiencies  at  USDA  is,  "Who  is  accountable  to  the  Secre¬ 
tary?"  At  the  time  of  our  review,  there  was  no  single  official 
the  Secretary  could  hold  fully  accountable  for  overall  management 
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of  computer  and  information  resources  in  his  organization.  In 
practice,  responsibilities  for  data  processing  are  not  central¬ 
ized;  they  are  shared  throughout  USDA.  Responsibility  for  ADP 
management  is  divided  among  the  agencies  and  three  levels  within 
the  Department. 

Generally,  agencies  are  responsible  for  the  effective  use 
and  management  of  ADP  within  their  organizations,  including  the 
responsibility  to  assess  their  program  requirements.  Data 
Services  has  interpreted  this  responsibility  to  mean  that  agen¬ 
cies  have  full  authority  to  fund  and  develop  their  own  automated 
information  systems  subject  only  to  certain  standards  and  security 
requirements  prescribed  by  the  central  ADP  office.  Agencies  do 
need  technical  approval  from  the  central  office  if  a  proposed 
system  exceeds  certain  dollar  thresholds  and  requires  procurement 
action.  However,  if  an  agency  develops  a  system  with  in-house 
resources,  technical  approval  is  not  required. 

Responsibility  for  central  ADP  management  is  shared  by  the 
Assistant  Secretary  for  Administration,  the  O&F  Director,  and 
the  head  of  Data  Services. 

Under  the  responsibilities  as  delegated  in  the  USDA  Adminis¬ 
trative  Regulations,  the  Director,  O&F,  has  the  authority  and 
responsibility  over  the  entire  area  of  ADP  and  telecommunications 
under  delegations  of  authority  received  from  the  Assistant  Secre¬ 
tary  for  Administration.  The  Director  reports  to  the  Assistant 
Secretary  for  Administration.  Generally,  the  highest  level 
within  USDA  that  approves  ADP/ telecommunications  matters  is  that 
of  the  Director,  O&F.  Major  changes  in  policy  are  brought  to 
the  attention  of  the  Assistant  Secretary  for  Administration,  the 
Deputy  Secretary,  and,  if  need  be,  to  the  Secretary  for  consider¬ 
ation. 

The  day-by-day  responsibility  for  overseeing  ADP  and  tele¬ 
communications  within  USDA  is  the  responsibility  of  the  Deputy 
Director,  Data  Services.  (This  official  is  a  deputy  to  the  Direc¬ 
tor  of  the  Office  of  Operations  and  Finance  and  is  the  head  of 
Data  Services.)  This  office  reports  to  the  Director  of  O&F.  The 
Deputy  Director,  Data  Services,  is  considered  the  top  ADP  operat¬ 
ing  official  in  USDA. 

No  top-level  forum  exists 
to  address  USDA-wide  ADP  matters 

Any  resource  that  is  critical  to  effectively  accomplishing 
an  organization's  objectives  requires  the  attention  of  top  manage¬ 
ment.  A  steering  committee  is  an  accepted  way  for  top  management 
to  provide  leadership  and  direction  and  to  assure  efficient  and 
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effective  use  of  information  resources.  Our  reports  1/  have 
repeatedly  stressed  the  need  for  and  importance  of  a  steering 
committee. 
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USDA  does  not  have  an  effective  top-level  forum  to  address 
USDA-wide  ADP  matters.  A  Management  Council  of  Department  and 
agency  administrators  exists  but  only  intermittently  discusses 
ADP  matters.  An  ADP  Policy  Advisory  Board  formed  several  years 
ago  has  floundered  and  rarely  meets.  A  lower  level  group  of 
senior  ADP  officials  meets  regularly  but  serves  as  a  coordinating 
group  and  vehicle  for  the  exchange  of  information. 

The  objectives  of  the  Management  Council  are,  first,  to 
better  acquaint  the  chief  administrative  officers  in  the  agen¬ 
cies  with  their  counterparts  and  activities  carried  out  by  these 
peers.  Secondly,  the  Management  Council  serves  as  a  sounding 
board  for  the  management  initiatives,  improvement  ideas,  and 
suggestions  of  any  of  its  members,  principally  the  Assistant 
Secretary  for  Administration.  Thirdly,  the  Management  Council 
acts  as  a  coordinating  body  to  deal  with  management  problems 
throughout  USDA. 

The  Management  Council  usually  meets  every  month.  It  does 
not  routinely  discuss  or  provide  policy  guidance  on  ADP/tele- 
communications  matters,  although  matters  of  ADP  policy  do  come 
up  for  discussion  during  its  meetings.  The  Director,  O&F,  and 
the  Deputy  Director,  Data  Services,  are  members  of  the  Council. 

In  House  Report  94-1224,  dated  June  8,  1976,  the  Agriculture 
Subcommittee  of  the  House  Committee  on  Appropriations  indicated 
that  it  expected  an  ADP  Policy  Advisory  Board  to  be  established 
within  USDA,  such  a  Board  to  consist  in  part  of  the  Administrators 
or  their  designees  from  each  of  the  larger  USDA  agencies,  for  the 
purpose  of  allowing  agencies  to  participate  more  fully  in  the 
establishment  of  departmental  ADP  policy.  Developments  within  as 
well  as  outside  the  Department  indicated  the  need  for  more  direct 
involvement  of  senior  agency  management  officials  in  the  Depart¬ 
ment's  efforts  to  more  effectively  manage  ADP  resources. 

Even  though  a  congressional  committee  recommended  the 
establishment  of  an  ADP  Advisory  Board  and  the  need  for  it  was 


l./"National  Bureau  of  Standards  Needs  Better  Management  of  Its 
Computer  Resources  To  Improve  Program  Effectiveness"  (CED-79- 
39,  Apr.  17,  1979);  "Inadequacies  in  Data  Processing  Planning 
in  the  Department  of  the  Interior"  ( FGMSD-78-41 ,  June  23,  1978); 
"Inadequacies  in  Data  Processing  Planning  in  the  Department  of 
Commerce"  ( FGMSD-78-27 ,  May  1,  1978);  "Farmers  Home  Administra¬ 
tion  Needs  To  Better  Plan,  Direct,  Develop,  and  Control  Its 
Computer-Based  Unified  Management  Information  System"  (CED-78- 
68,  Feb.  27,  1978);  and  "Stronger  Management  of  EPA's  Informa¬ 
tion  Resources  Is  Critical  to  Meeting  Program  Needs"  (CED-80-18, 
Mar.  10,  1980). 


recognized  by  USDA  ADR  officials,  the  Board  has  not  developed 
into  an  effective  forum.  The  ADP  Advisory  Board,  as  originally 
constituted,  had  as  its  objective  to  provide  policy  guidance 
based  on  the  del i berat i ons  of  its  members  in  areas  of  ADP/ tele¬ 
communications  .  The  ADP  Advisory  Board  was  disbanded  in  1977 
after  about  1  year  due  to  the  inability  of  its  supporters  to  main¬ 
tain  interest  at  the  level  of  the  assistant  secretaries,  agency 
administrators,  and  the  deputy  administrators  for  management 
who  constituted  the  membership.  ft  has  been  reestablished  by  USDA 
Administrative  Regulations,  but  it  has  met  only  twice  since  1977. 
The  regulations  state  that  the  Board  will  meet  at  least  quarterly. 

The  ADP  Resource  Exchange  Program  was  established  in 
1974  by  the  senior  ADP  managers  independent  of  the  departmental 
ADP  staff  office.  The  initial  purpose  of  the  group  was  to  pro¬ 
vide  a  forum  for  joint  dissent  regarding  ADP  policies  and  the 
quality  of  ADP  services  provided  by  the  departmental  computer 
centers.  Subsequently,  the  group  revised  its  charter  and  bylaws. 
Currently,  the  Resource  Exchange  Program's  basic  purpose  is  to 
serve  as  an  information  exchange  and  as  a  vehicle  for  regular 
meetings  with  Data  Services  management. 

BESIDES  ADP,  USDA  HAS  HAD  OTHER  PROBLEMS 
WITH  MANAGING'  INFORMATION  RESOURCES 

Besides  the  ADP  deficiencies  noted  on  page  11,  we  have  is¬ 
sued  reports  identifying  other  non-ADP  problems  USDA  has  had 
with  managing  information  resources.  These  problems  dealt  with 
records  management  and  paperwork  management. 

Records  management  includes  various  managerial  activities 
related  to  records  creation,  maintenance  and  use,  and  disposition. 
There  are  nine  traditional  records  management  functions:  corre¬ 
spondence,  directives,  forms,  reports,  copy,  mail,  files,  micro¬ 
graphics,  and  disposition.  Records  management  is  an  integral 
part  of  effective  organizational  administration. 

In  our  report  "Federal  Records  Management:  A  History  of 
Neglect"  (PLRD-81-2,  peb.  24,  1981),  we  stated  that  serious 
deficiencies  with  records  management  have  existed  for  years 
among  Federal  Government  agencies.  When  we  visited  the  Depart¬ 
ment  of  Agriculture  during  that  review,  the  departmental  direc¬ 
tives  system  was  in  disarray,  according  to  a  departmental  memo¬ 
randum.  The  memorandum  also  stated  that  many  directives  re¬ 
flected  out-af-date  and  inadequate  policies  and  procedures.  The 
system,  which  was  developed  in  the  mid-1940s,  required  moderni¬ 
zation.  A  97  5  inspection  report  on  USDA,  prepared  by  the  Na¬ 
tional  Archives  and  Records  Service,  recommended  that  USDA 
develop  and  implement,  by  directive,  USDA-wide  programs  for 
managing  correspondence,  directives,  mail,  files  maintenance, 
and  records  disposition.  We  noted  in  our  report  that  a  Feb¬ 
ruary  1980  USDA  contract  to  improve  the  directives  system  was 
the  first  step  toward  complying  with,  the  1975  recommendations. 


Paperwork  management  deals  with  controlling  the  paperwork 
burden  that  the  Federal  Government  imposes  on  the  publ i c  by  sub¬ 
jecting  proposed  reporting  requirements  to  a  clearance  review 
and  approval  process.  One  objective  of  the  process  is  to  protect 
the  public  from  unneeded,  redundant,  or  poorly  conceived  infor¬ 
mation  required  by  the  Federal  Government. 

In  our  report  "Department  of  Agriculture:  Actions  Needed 
To  Enhance  Paperwork  Management  and  Reduce  Burden"  (GGD-80-14, 

Mar.  10,  1980),  we  concluded  that  I'SDA's  paperwork  management 
program  needed  improvement.  Shortcomings  in  the  program  allowed 
(1)  the  collection  of  unused  information  and  (2)  the  use  of 
reporting  requirements  which  were  not  approved.  Over  1,100 
unapproved  reporting  requirements  v,«  re  in  use.  In  an  earlier 
report,  "Protecting  the  Public  from  Unnecessary  Federal  Paper¬ 
work:  Does  the  Control  Process  Work?"  (GGD-79-70,  Sept.  24, 

1979),  we  disclosed  that  the  reports  clearance  process  of  USDA 
and  two  other  departments  lacked  strong  controls  at  all  levels 
of  review.  USDA  did  not  have  evaluation  mechanisms  to  assure 
that  the  process  was  working  and  seldom  conducted  postaudits 
of  reporting  requirements,  even  though  such  reviews  might  have 
been  cost  effective. 

EFFECTIVE  IMPLEMENTATION  OF 
THE  PAPERWORK "REDUCTION  ACT  CAN 
REMEDY ~ U3DA 1 S  ADP  DEFICIENCIES 

The  Paperwork  Reduction  Act  of  1980  can  remedy  many  of  USDA's 
ADP  deficiencies  if  it  is  effectively  implemented  in  an  aggressive 
and  assertive  manner.  The  act  requires  each  Federal  agency  to 
designate  a  "senior  official"  responsible  for  carrying  out  infor¬ 
mation  activities  including  ADP  in  an  efficient,  effective,  and 
economical  manner.  We  believe  that  if  this  senior  official  and 
the  supporting  management  structure  are  effectively  placed  and 
organized  and  a  meaningful  management  program  is  developed,  USDA 
should  materially  improve  its  planning,  control,  direction,  and 
accountability  for  information  resources  management. 

The  Paperwork  Reduction  Act  embodies 
IRM  concept 

In  the  last  few  years,  an  information  resources  management 
concept  has  emerged  as  a  focus  of  managing  information  activi¬ 
ties.  Although  lacking  a  concise  or  universal  definition,  the 
IRM  concept  has  become  a  framework  for  planning  more  responsive 
and  coordinated  information  management  organization  structures 
throughout  Government  and  the  private  sector.  In  brief,  IRM  is 
viewed  as  an  integration  of  management  responsibilities  for  the 
control  of  information-related  activities  and  related  processes. 

It  includes  the  planning  and  management  of  information  collection, 
use,  and  dissemination  as  well  as  the  management  of  information 
technolog ies . 
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Historically,  information  management  has  been  a  fragmented 
activity  shared  among  the  traditionally  independent  elements  of 
an  organization.  Many  of  the  critical  data-hand 1 i ng  activities 
(payroll,  invoices,  payments,  inventories,  etc.)  of  an  organiza¬ 
tion  have  been  located  in  the  administrative  or  financial  manage¬ 
ment  offices.  Automation  of  these  activities  has  resulted  in 
placing  management  responsibilities  for  computers  and  information 
systems  in  the  office  of  an  organization's  administrator  or 
comptroller.  Since  information-related  programs  also  may  be  ad¬ 
ministered  by  other  elements  in  an  organization,  in  many  instances 
a  dispersed  information  management  structure  has  resulted.  For 
example,  activities  such  as  information  and  library  services, 
statistical  functions,  information  programs,  and  associated  activ¬ 
ities  (policy,  reports,  management,  procurement,  and  communica¬ 
tions)  may  not  be  centrally  managed.  Often,  responsibility  for 
managing  these  activities  and  services  is  shared,  and  in  some 
instances  the  jurisdictional  responsibility  may  not  be  clear. 

As  a  result  of  this  fragmented  approach,  information  resources 
sometimes  have  been  poorly  managed  and  inappropriately  used. 

The  current  rationale  for  comprehensive  management  of 
information-related  activities  is  that  these  activities  contribute 
to  an  organization's  effectiveness.  According  to  the  general 
IRM  concept,  the  IRM  office  within  an  organization  should  provide 
a  central  focus  for  all  those  information  activities  that  support 
and  serve  the  organization.  Also,  this  office  should  reflect 
the  organization's  specific  directions  and  goals  and  be  consistent 
with  good  management  practices.  The  objectives  and  goals  of  the 
IRM  office  should  be  formulated  to  provide  a  cohesive  management 
framework  consistent  with  organization  requirements  and  values. 

The  IRM  policies  and  procedures  should  provide  a  foundation 

for  developing  the  information  architecture  and  relevant  programs 

required  by  the  organization. 

The  Congress  has  had  a  continuing  interest  in  the  management 
of  information  and  associated  information  policy,  especially  Fed¬ 
eral  information  and  ADP  management.  Acquisition  of  ADP  and  in¬ 
formation  systems  and  equipment;  use,  collection,  and  dissemination 
of  information;  and  development  of  information-related  standards 
have  been  of  particular  concern.  The  Congress  also  has  encouraged 
more  effective  policies  to  limit  information  disclosures,  preserve 
personal  privacy,  reduce  paperwork  burden,  and  improve  information 
management  in  Federal  programs. 

These  congressional  concerns  about  how  the  Federal  Government 
manages  its  information  resources  culminated  in  the  passage  of  the 
Paperwork  Reduction  Act.  The  act  requires  uniform  and  consistent 
information  policies  and  practices  and  strengthens  and  centralizes 
certain  Federal  information  management  activities.  A  function 
of  both  the  act  and  the  concept  is  the  focus  on  centralization 
of  information-related  activities  management.  In  the  act  the 
management  of  information  activities  is  focused  within  the  Office 


of  Management  and  Budget  (OMB)  by  creating  a  new  office  structure 
and  in  the  individual  Federal  agencies  by  designation  of  a  "senior 
official. " 

The  act  establishes  an  Office  of  Information  and  Regulatory 
Affairs  in  OMB  with  certain  responsibilities,  including  over¬ 
sight  of  Federal  agencies,  to  ensure  that  information  management 
activities  are  carried  out  efficiently  and  effectively.  The 
act  sets  out  these  six  categories  of  information  management 
activities:  paperwork  control,  statistical  policy  and  coordina¬ 

tion,  records  management,  privacy,  ADP  and  telecommunications, 
and  agency  rulemaking  that  involves  a  collection  of  information 
requirements.  In  addressing  ADP  and  telecommunications,  the  aut 
directs  that  OMB  establish  polices,  principles,  standards,  and 
guidelines;  oversee  the  establishment  of  standards;  and  monitor 
compliance  with  sections  110  and  111  of  the  Federal  Property  and 
Administrative  Services  Act  of  1949  (Brooks  Act).  As  required  by 
the  Paperwork  Reduction  Act,  OMB  would  provide  advice  and  guid¬ 
ance  on  the  acquisition  and  use  of  ADP  and  telecommunications 
equipment  and  coordinate,  through  budget  reviews,  agency  propos¬ 
als  for  relevant  information-processing  equipment.  The  act  also 
directs  that  OMB  promote  effective  use  of  information  technology, 
improve  the  use  and  dissemination  of  data,  and  initiate  and  re¬ 
vise  proposals  for  changes  in  legislation,  regulations,  and  agency 
procedures  related  to  Federal  use  of  information  technology. 

In  addition,  the  act  provides  that  each  agency  head  shall 
designate  by  July  1,  1981,  a  senior  official  who  will  be  respon¬ 
sible  for  ensuring  agency  compliance  with  Federal  information 
policies,  principles,  standards,  and  guidelines.  The  official 
will  also  be  responsible  for  ensuring  that  the  agency  carries 
out  its  information  management  activities  efficiently,  effec¬ 
tively,  and  economically.  The  official  will  also  be  required  to 
periodically  review  the  agency's  information  management  activi¬ 
ties,  including  the  "planning,  budgeting,  organizing,  directing, 
training,  promoting,  controlling,  and  other  managerial  activities 
involving  the  collection,  use  and  dissemination  of  information." 

How  can  the  Paperwork  Reduction  Act 
improve  USDA's  information  resources 
management? 

We  believe  that  effective  implementation  of  the  Paperwork 
Reduction  Act  can  improve  USDA's  planning,  control,  direction, 
and  accountability  for  information  resources  management. 

First,  and  most  importantly,  it  will  assign  accountability 
by  establishing  a  single  individual  in  USDA  with  a  clear  mandate 
to  carry  out  USDA's  responsibilities  under  the  act. 

Second,  the  act  emphasizes  the  importance  of  information 
resources  management  by  requiring  that  the  senior  official 
report  to  the  head  of  the  agency. 
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Third,  the  act  emphasizes  the  need  for  top-level  agency 
oversight  and  control  to  ensure  that  an  agency  efficiently, 
effectively,  and  economically  uses  its  information  resources 
and  complies  with  information  policies,  principles,  standards, 
and  guidelines  prescribed  by  OMB.  Specifically,  the  act  states 
that  each  agency  shall 

»*  *  *  periodically  review  its  information  management 
activities  including  planning,  budgeting,  organizing, 
directing,  training,  promoting,  controlling  and  other 
managerial  activities  involving  the  collection,  use 
and  dissemination  of  information." 


Fourth,  if  USDA  is  to  effectively  carry  out  its  responsibili¬ 
ties  under  the  act,  it  will  need  a  good  planning  process.  Good 
planning  is  a  prerequisite  to  efficient  and  effective  operations. 

And  fifth,  the  act  provides  clear  direction  by  giving  the 
senior  official  responsibility  for  all  information  activities 
through  the  entire  process  of  collection,  dissemination,  and  use. 
Both  the  House  and  Senate  reports  state  that  the  senior  official 
has  approval  authority  over  the  agency's  information  functions. 


The  Paperwork  Reduction  Act 
guidance  on  organizational 


pr  ovides 
structure 


The  Paperwork  Reduction  Act  does  not  prescribe  any  specific 
organizational  structure  for  Federal  agencies  in  carrying  out 
their  responsibilities  under  the  act.  However,  the  act,  along 
with  its  legislative  history  and  implementing  guidance  being 
prepared  by  OMB,  does  provide  guidance  to  Federal  agencies. 


The  act  states  that  each  agency  (defined  as  any  executive 
department)  shall  designate  a  "senior  official"  who  will  "report 
directly"  to  the  "agency  head."  Also,  the  act  sets  out  certain 
responsibilities  for  managing  information  resources  that  involve 
compliance  and  accountability,  indicating  that  the  senior  official 
will  need  to  exert  substantial  influence  over  the  use  of  informa¬ 
tion  resources  and  will  need  significant  authority. 


In  House  Report  No.  96-835  accompanying  the  bill  (H.R.  6410), 
the  following  statements  on  legislative  intent  were  included: 


"It  is  also  expected  that  certain  restructuring  of 
activities  may  be  required  within  the  agencies.  The 
Committee  expects  that  each  agency  will  reorganize, 
to  the  extent  necessary,  so  that  the  counterpart 
activities  within  the  agency  to  those  assigned  to  the 
OMB  Office  of  Federal  Information  Policy  [later  amended 
to  Office  of  Information  and  Regulatory  Affairs]  will 
report  directly  to  the  senior  official  designated  by 
the  agency  head.  This  realignment  should  provide  for 
greater  coordination  among  the  agency's  information 
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activities  as  well  as  greater  visibility  within  the 
agency. " 

*  *  *  *  * 

"Under  this  legislation,  the  responsibility  and  account¬ 
ability  for  the  agency's  information  management  activities 
is  in  that  senior  official  designated  by,  and  reporting 
directly  to,  the  agency  head  under  Section  3506(b)  of 
proposed  new  chapter  35,  Title  44,  United  States  Code. 

A  proposed  structure  for  an  agency  will  comply  with  the 
intent  of  H.R.  6410  provided  that  (a)  the  agency's  infor¬ 
mation  functions,  which  relate  to  the  OMB  Director’s 
functions  listed  in  Section  3504  (a),  are  under  the 
jurisdiction  of  the  designated  agency  official  and  (b)  the 
designated  official  has  final  approval  authority  over  the 
agency's  information  functions.  Subcomponents  may  be 
created  under  the  designated  agency  official  as  necessary 
to  reflect  the  agency's  operating  needs,  as  long  as  such 
subcomponents  shall  report  directly  to,  and  be  under  the 
direction  of,  such  official.  This  recognizes  that  one 
structure  will  not  be  appropriate  for  all  agencies." 

Similar  language  is  included  in  the  Senate  report  1/  accom¬ 
panying  S.  1411,  the  Senate  version  of  the  bill. 

The  House  report  also  includes  language  that  constituent 
agencies  in  a  Government  department  will  be  expected  to  establish 
central  information  management  units,  as  follows: 

"The  appropriate  structure  under  H.R.  6410  is  somewhat 
different  in  the  case  of  a  Government  department 
having  constituent  agencies,  such  as  the  Department  of 
Defense.  The  Committee  expects  that  each  constituent 
agency  will  establish  a  central  information  manage¬ 
ment  unit,  subject  to  the  review  and  approval  of  the 
department-level  unit  headed  by  the  designated  senior 
official.  The  basic  reason  for  this  organization  is 
that  a  department  has  the  responsibility  to  consider 
its  mission  in  a  department-wide  sense,  whereas  a 
constituent  agency  will  generally  consider  only  its 
own  mission.  In  some  cases,  an  individual  action  may 
raise  a  conflict  between  a  constituent  agency  and  its 
department.  Consistent  with  the  objectives  of  this 
legislation  and  within  statutory  limits,  the  con¬ 
stituent  agency  must  conform  its  needs  and  interests 
to  those  of  the  department." 


1,/Senate  Report  No.  96-930  (96th  Cong.,  2d  session.  Sept.  8,  1980). 
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OMB  prepared  draft  guidance,  as  of  March  1981,  to  tell 
agencies  how  to  designate  the  senior  official.  It  stated: 

"While  the  specific  organizational  placement  and 
structure  shall  be  decided  by  the  agency  head,  OMB 
expects  that  the  designated  senior  official  will 
have  a  substantial,  personal,  and  daily  involvement 
in  the  management  of  the  agency's  information 
resources . " 

In  addition,  the  draft  guidance  recommended  that  responsibilities 
beyond  those  stated  in  the  act  should  be  assigned  to  the  senior 
official  only  if  the  additional  functions  do  not  interfere  with 
the  performance  of  the  authorities  and  responsibilities  required 
by  the  act.  Finally,  OMB  recommends  that  the  senior  official 
not  be  responsible  for  operating  agency  computer  facilities 
or  managing  an  information  center.  OMB's  logic  behind  this 
recommendation  is  that  while  the  senior  official  has  a  responsi¬ 
bility  to  ensure  that  information  resources  are  managed  effec¬ 
tively,  efficiently,  and  economically,  day-to-day  operational 
responsibility  for  collecting,  maintaining,  and  disseminating 
information  should  remain  with  program  managers. 

How  should  USDA  implement  the 
Paperwork  Reduction  Act? 

Based  on  implementing  guidance  contained  in  the  act  and  its 
legislative  history,  the  draft  OMB  guidance,  and  our  review  of 
USDA's  ADP  management,  we  believe  effective  implementation  of  the 
Paperwork  Reduction  Act  at  USDA  would  involve  (1)  designating 
as  the  senior  official  a  high-ranking  official,  other  than  the 
Assistant  Secretary  for  Administration,  with  full-time  responsi¬ 
bility  for  IRM  matters,  (2)  establishing  a  separate,  independent 
office,  (3)  developing  and  implementing  an  IRM  program,  (4)  estab¬ 
lishing  a  top-level  steering  committee  or  similar  group  to  advise 
the  senior  official  on  policy  matters,  and  (5)  establishing 
central  management  units  in  each  USDA  agency  modeled  after  the 
senior  official's  office. 

Based  on  our  discussions  with  various  Government  officials, 
it  appears  that  several  departments  will  designate  the  Assist¬ 
ant  Secretary  for  Administration  as  the  senior  official  since 
this  person  already  has  responsibility  for  most  of  the  functions 
in  the  act.  While  this  may  be  appropriate  in  some  departments, 
we  believe  it  is  vitally  important  at  USDA  to  remove  IRM  policy 
and  oversight  responsibilities  from  under  the  Assistant  Secretary 
for  Administration.  USDA  is  a  huge,  sprawling  organization  made 
up  of  some  30  diverse  agencies  and  offices  with  over  100,000  em¬ 
ployees  and  thousands  of  field  offices.  It  is  also  an  information¬ 
intensive  organization  which  could  not  carry  out  its  mission  with¬ 
out  information  and  the  supporting  resources  and  technology.  A 
separate,  high-level  office  whose  principal  responsibility  is  IRM 
is  justified  based  on  the  critical  importance  of  information  to 
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USDA.  As  shown  in  the  oLganization  chart  on  page  4,  the  Assistant 
Secretary  for  Administration  has  important  financial,  legal,  per¬ 
sonnel,  and  other  administrative  responsibilities.  We  also  believe 
designating  the  Assistant  Secretary  for  Administration  as  USDA's 
senior  official  does  not  comply  with  the  criteria  in  OMB's  draft 
guidance  to  agencies  on  implementing  the  Paperwork  Reduction  Act. 
Given  the  size  and  diversity  of  USDA,  we  believe  the  best  alter¬ 
native  is  to  select  someone  whose  sole  responsibility  is  IRM. 

This  would  exclude  the  Assistant  Secretary  for  Administration. 

The  senior  official  will  need  to  be  a  high-ranking  offi¬ 
cial  who  can  devote  adequate  and  continuous  attention  to  carry¬ 
ing  out  the  responsibilities  under  the  act  and  who  can  over¬ 
see  the  IRM  activities  of  USDA's  largely  autonomous  agencies. 

It  was  evident,  based  on  our  discussions  with  USDA  agency  ADP 
officials,  that  they  have  not  fully  recognized  the  need  for 
or  desirability  of  having  a  strong  central  office  established 
with  responsibility  and  authority  for  information  resources 
management.  Generally,  agency  personnel  feel  that  a  strong 
central  office  will  undercut  agency  authority.  At  the  same 
time,  they  also  pointed  out  that  assistant  and  under  secretaries 
responsible  for  USDA's  programs  play  a  powerful  role  in  the 
organization  and  have  significant  influence  with  the  Secretary. 

There  will  be  times  when  the  senior  IRM  official's  views 
will  conflict  with  the  views  held  by  USDA's  agency  program 
managers.  The  outcome  of  these  conflicts  could  have  serious 
consequences  given  the  critical  importance  of  IRM  policy.  In 
our  opinion,  unless  USDA's  senior  official  is  on  the  same 
level  as  the  program  assistant  secretaries,  IRM  matters  will 
not  receive  the  same  consideration  as  program  requirements. 

Because  the  act  intended  an  agency's  information  activities 
to  be  managed  as  an  Integrated  process  and  for  subcomponents 
to  be  under  the  senior  official's  direction,  we  believe  a  separate 
office  is  necessary.  USDA  should  also  establish  in  each  agency 
a  central  information  management  unit  as  suggested  in  the  House 
report  on  the  Paperwork  Reduction  Act,  subject  to  the  review  and 
approval  of  the  senior  official.  These  units  would  be  modeled 
after  the  senior  official's  office. 

The  senior  official  will  also  need  to  develop  an  IRM  pro¬ 
gram  so  that  responsibilities  required  by  the  act  can  be  carried 
out  systematically  in  a  logical,  planned  manner.  An  IRM  program 
would  include  policies,  standards,  a  comprehensive  long-range 
plan,  goals  and  measurable  objectives,  and  a  management  system  for 
evaluating  performance.  Agency  top  management  must  participate 
in  developing  and  implementing  USDA's  IRM  program.  A  steering 
committee  or  similar  mechanism  of  top-level  agency  representa¬ 
tives  would  help  advise  the  senior  official  on  policy  issues. 
However,  it  must  be  understood  that  the  senior  official  is  the 
one  responsible  for  USDA's  IRM  activities. 
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Because  of  potential  conflict  between  operations  and  the 
senior  official's  oversight  responsibility,  the  senior  offi¬ 
cial  may  not  want  to  include  operational  functions,  such  as 
the  Department's  computer  centers,  in  his  office.  However,  the 
decision  on  where  in  USDA's  organization  to  place  these 
information-related  operational  functions  should  be  made  by  the 
senior  official. 

In  April  1981  while  we  were  finalizing  the  report  we  were 
informed  that  USDA  had  designated  the  Secretary's  Executive  Assist¬ 
ant  as  the  senior  official  under  the  Paperwork  Reduction  Act.  We 
were  told  by  the  Executive  Assistant  that  additional  questions  on 
implementing  the  act  were  under  discussion  and  no  other  decisions 
had  been  made. 

CONCLUSIONS 


Since  1975  we  and  USDA's  OIG  have  reported  on  ADP  and  other 
information  resources  management  deficiencies  existing  in  USDA. 

In  our  current  review  we  found  that  these  continuing  ADP  deficien¬ 
cies  are  caused  by  weak  central  management.  Adequate  planning, 
control,  direction,  and  accountability  are  critical  elements 
missing  from  USDA's  ADP  management  process  and  have  been  reported 
as  missing  from  other  IRM  functions. 

We  believe  that  the  recently  passed  Paperwork  Reduction 
Act  can  materially  improve  USDA's  information  resources  manage¬ 
ment,  including  ADP.  During  processing  of  our  report  the  Secre¬ 
tary  designated  his  Executive  Assistant  as  the  senior  official. 

We  believe  this  is  a  positive  step  because  it  places  IRM  respon¬ 
sibilities  outside  the  office  of  the  Assistant  Secretary  for 
Administration  and  separates  these  responsibilities  from  other 
activities,  such  as  finance,  accounting,  and  personnel.  How¬ 
ever,  there  is  much  more  to  be  done  for  USDA  to  effectively  im¬ 
plement  the  act.  The  "senior  IRM  official"  should  not  be  just  a 
title.  He  will  have  to  devote  substantial  attention  to  IRM  mat¬ 
ters.  He  will  need  a  strong  management  structure  and  a  meaningful 
IRM  program  to  carry  out  his  responsibilities  under  the  act.  In 
subsequent  chapters,  we  have  directed  our  recommendations  to 
specific  activities — management  of  software  projects,  computer 
center  operations,  security,  and  planning — that  should  be  part 
of  the  senior  official's  responsibility  and  authority  and  that 
should  be  included  as  a  part  of  USDA's  IRM  program. 

RECOMMENDATIONS  TO  THE 
SECRETARY  OF  AGRICULTURE 


We  recommend  that  the  Secretary  of  Agriculture 

—  issue  a  memorandum  to  agency  heads  describing  the 
responsibilities  and  authority  of  the  senior  official 
with  specific  attention  to  the  senior  official's 
authority  over  agencies'  IRM  activities; 
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— designate  USDA's  senior  official  an  assistant  secretary 
or  equivalent  level; 

— establish  a  separate,  central  IRM  office  headed  by 
the  senior  official; 

—  include  as  part  of  the  IRM  office  such  IRM-related  sub¬ 
components  as  deemed  necessary  for  the  senior  official  to 
carry  out  his  responsibilities; 

— establish  a  top-level  USDA  steering  committee  or  similar 
group  of  agency  representatives  to  provide  the  senior 
official  with  advice  and  recommendations  on  policy  and 
other  significant  IRM  matters; 

—  issue  a  memorandum  to  agency  heads  stressing  the  need 
for  involving  top  management  in  information  resources 
management  and  in  the  activities  of  the  USDA  steering 
committee ; 

— direct  the  senior  official  in  carrying  out  his  informa¬ 
tion  activities  to  develop  and  implement  a  USDA-wide  IRM 
program;  and 

— direct  USDA  agencies  and  offices  to  establish  central 
information  management  units  subject  to  the  senior 
official's  review  and  approval. 
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CHAPTER  3 

MORE  DEPARTMENTAL  GUIDANCE  AND  STRONGER  CONTROL 
COULD  IMPROVE  SOFTWARE  MANAGEMENT 


USDA's  senior  official  designated  under  the  Paperwork 
Reduction  Act  should  ensure  that  agencies  improve  the  control 
and  planning  of  their  software  development,  conversion,  and 
maintenance  activites.  In  carrying  out  these  activities,  agen¬ 
cies  frequently  are  not  following  accepted  management  princi¬ 
ples,  such  as  conducting  user  requirements  analyses,  preparing 
cost/benefit  studies  and  comprehensive  project  plans,  and 
assigning  full-time  project  managers.  These  management  weak¬ 
nesses  have  contributed  heavily  to  such  undesirable  conditions 
as 


— delays  and  cost  overruns  in  software  development  and 

conversion  projects  totaling  millions  of  dollars  at  three 
USDA  agencies; 

— continued  use  of  obsolete,  maintenance-intensive  computers 
alongside  underutilized  modern  equipment;  and 

—  ineffective  management  of  USDA’s  software  maintenance 
act iv it ies . 

The  objective  of  investing  in  data  processing  is  to  develop 
automated  information  systems  and  applications  software  that 
are  cost  effective  and  meet  user  needs  and  to  do  so  within 
cost  and  time  limitations.  Since  requirements  change  over  time, 
applications  not  completed  on  schedule  may  not  meet  user  needs. 
Furthermore,  cost  and  schedule  overruns  can  diminish,  and  even 
eliminate,  the  cost  effectiveness  of  an  application. 

USDA's  senior  official  must  be  given  a  strong  oversight 
role  to  provide  effective  guidance  for  agency  software  activities 
and  to  ensure  the  effective  and  efficient  use  of  the  Department's 
information  resources. 

THE  IMPORTANCE  OF  SOFTWARE 


In  the  early  days  of  computers,  the  price  of  the  equipment 
(hardware)  was  the  major  ADP  cost.  The  computer  programs  (soft¬ 
ware),  which  make  the  equipment  operate,  cost  relatively  little. 
However,  software  now  costs  considerably  more  than  hardware, 
which  has  steadily  declined  m  price  because  of  technological 
advances . 

USDA  does  not  accumulate  cost  data  on  software  activities 
as  a  separate  item.  However  ,  the  Assistant  to  the  Director  for 
Technology  and  Development,  Office  of  Operations  and  Finance, 
estimates  that  approximately  two-thirds  of  USDA's  ADP  funds 
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ai e  devoted  to  software  applications  development  and  maintenance. 
This  is  probably  a  conservative  estimate.  We  noted  in  our  recent 
report,  "Wider  Use  of  Better  Computer  Software  Technology  Can 
Improve  Management  Control  and  Reduce  Costs"  ( PGMSD-80-38 , 

Apr.  29,  1980),  that  recent  studies  predict  that  by  1985  over 
90  percent  of  the  cost  of  ADP  will  be  attr  ibutable  to  software. 
USDA's  total  estimated  ADP  budget  for  fiscal  year  1981  is  $158 
million.  Using  the  two-thirds  ratio  of  software  to  total  ADP 
costs,  we  estimate  USDA's  software  costs  dur  ing  fiscal  year  1981 
at  $105  million. 

The  effective  management  of  software  is  important  because 
of  its  high  cost,  its  critical  role  in  managing  USDA's  billions 
of  dollars  of  assets,  and  its  support  of  agency  programs.  The 
head  of  Data  Services  believes  that  managing  software  will  be 
USDA's  biggest  ADP  challenge  in  the  1980s. 

Software  is  generally  grouped  into  systems  software,  util¬ 
ity  software,  and  applications  software. 

Systems  software  automates  the  control  and  operation  of 
the  computer  and  auxiliary  equipment.  It  controls  the  running 
of  applications  and  utilities  (see  below),  controls  the  alloca¬ 
tion  of  computer  resources,  and  reports  on  the  resources  used. 
Systems  software  is  usually  supplied  by  the  computer  vendor 
but  may  be  obtained  from  other  suppliers. 

Utility  software  aids  the  tasks  of  computer  programers 
and  others  who  work  with  the  computer.  It  includes  language 
translators  and  stored  routines  for  very  common  tasks  such  as 
sorting  data.  (Language  translators  are  compilers  and  inter¬ 
preters  which  transform  the  statements  of  programing  languages 
written  by  humans  into  internal  machine  codes  which  directly 
control  computers.)  Utility  software  may  be  supplied  by  the 
hardware  vendor  or  independent  software  firms,  or  written  by 
the  user's  employees. 

Applications  software  automates  the  tasks  of  end  users. 
USDA's  applications  software  systems  are  directed  toward  sup¬ 
porting  agency  mission  functions,  such  as  managing  loan  portfo¬ 
lios,  managing  grain  and  commodity  inventories,  and  maintaining 
data  on  agricultural  producers'  allotments,  quotas,  plantings, 
and  marketings. 

Applications  software  systems  have  life  cycles  which  can 
be  divided  into  a  development  phase  and  an  operational  or  pro¬ 
duction  phase.  The  development  phase  consists  of  defining  the 
users'  requirements,  designing  the  system  and  computer  programs, 
programing,  and  testing.  The  operational  phase  begins  when  the 
applications  software  produces  its  first  user  output;  this  phase 
generally  includes  maintenance  and  conversion. 


OUR  PAST  REPORTS  PROVIDE  SOLUTIONS  TO 
GOVERNMENT-WIDE  MANAGEMENT  PROBLEMS 
IN  SOFTWARE  DEVELOPMENT 

For  over  12  years  we  have  reported  on  the  problems  asso¬ 
ciated  with  developing  software  application  systems  in  the  Fed¬ 
eral  Government.  About  $300  million  in  waste  was  identified  in 
these  development  efforts.  This  waste  of  money  and  effort 
could  have  been  mitigated  through  adherence  to  the  following 
generally  accepted  software  management  principles: 

— Development  of  comprehensive  project  plans  that  address 
major  aspects  of  the  system  and  tie  into  other  agency 
software  plans. 

— Involvement  by  top  management  in  large,  complex  software 
development  efforts. 

— Participation  by  the  system  users  throughout  the  devel¬ 
opment  process. 

— Assignment  of  project  managers  as  the  central  point  of 
authority  for  most  major  software  development  efforts. 

— Preparation  of  cost  estimates  and  economic  analyses. 

— Establishment  of  effective  procedures  to  compare  a  sys¬ 
tem's  progress  with  the  approved  cost,  schedule,  and 
performance  estimates. 

— Enforcement  of  established  procedures  for  approving  either 
new  design  efforts  or  major  enhancements  and  modifications 
to  existing  systems. 

USDA  SOFTWARE  MANAGEMENT 
RESPONSIBILITIES  ARE  DIVIDED 


Individual  USDA  agencies  are  responsible  for  planning, 
justifying,  managing,  controlling,  and  documenting  their  appli¬ 
cations  software  projects  in  accordance  with  Federal  and  Depart¬ 
ment  information-processing  standards,  procedures,  and  guidelines. 
Agencies  are  expected  to  base  their  decision  to  develop  a  new 
application  on  an  evaluation  of  a  well-documented  plan  that  con¬ 
siders  economics,  benefits,  priorities,  and  technical  feasibility. 

According  to  the  Department's  Administrative  Regulations, 

Data  Services  is  responsible  for  performing  the  following  soft¬ 
ware  management  functions:  (1)  act  as  technical  consultant  to 
agencies  in  defining  ADP  requirements,  (2)  guide  agencies  in  de¬ 
veloping  applications  software  systems,  (3)  review  planned  and 
operational  systems  in  terms  of  technical  feasibility,  cost  ef¬ 
fectiveness,  and  consistency  with  overall  Department  plans,  and 
(4)  maintain  awareness  of  current  and  planned  systems. 
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Currently,  Data  Services  has  no  authority  over  agency  in- 
house  development  efforts;  however,  software  development  ef¬ 
forts  that  involve  ADP/telecommunicat ions  procurements  are 
subject  to  a  technical  approval  process  by  Data  Services  when 
costs  rise  above  designated  dollar  thresholds.  Otherwise,  the 
agencies  are  not  required  to  receive  the  central  office's 
technical  approval  for  in-house  software  development  projects. 
Data  Services,  however,  is  responsible  for  providing  guidance 
to  agencies  and  staff  offices  for  developing  application  soft¬ 
ware  systems. 

As  we  discussed  in  chapter  2,  the  authority  of  Data  Serv¬ 
ices  over  agency  software  projects  is  unclear.  Data  Services 
does  not  systematically  review  agencies'  planned  software 
projects,  monitor  the  projects,  or  evaluate  the  projects  after 
they  are  operational.  As  a  result,  the  Department  does  not 
have  adequate  knowledge  of  the  agencies'  costly  software  ef¬ 
forts  . 


Based  on  the  extensive  delays  and  large  cost  overruns  some 
agencies  have  experienced  in  recent  software  efforts,  we  be¬ 
lieve  the  senior  official  designated  under  the  Paperwork  Reduc¬ 
tion  Act  needs  to  perform  a  strong  oversight  role  over  agencies' 
software  projects.  For  example,  if  Data  Services  had  adequately 
monitored  FmHA's  UMIS  project,  millions  of  dollars  of  wasted  ef¬ 
fort  might  have  been  prevented. 

AGENCIES  HAVE  NOT  EXERCISED  GOOD  CONTROL  OVER 
INTERNAL  SOFTWARE  APPLICATION  PROJECTS 

Agencies'  control  over  software  efforts  have  been  generally 
fragmented  and  inadequate.  USDA  agencies'  software  develop¬ 
ment  efforts  frequently  have  not  been  supported  by  adequate  user 
requirement  analyses,  project  plans,  and  strong  project  managers. 
We  found  they  often  did  not  follow  good  management  principles  in 
planning,  conducting  adequate  user  requirements  analyses,  and  as¬ 
signing  project  managers,  resulting  in 

— lengthy  delays  in  project  completion  and  significant  cost 
overruns ; 

— prolonged  operation  of  obsolete  and  inefficient  processes 
and  applications  systems  which  are  used  to  manage  billions 
of  dollars  of  assets;  and 

— underutilization  of  modern  in-place  computers  accompanied 
by  prolonged  and  costly  operation  of  redundant,  obsolete 
computer  systems. 

We  found  examples  of  problems  in  developing  or  redesigning 
applications  software  systems  at  the  Farmers  Home  Administration, 
the  Agricultural  Stabilization  and  Conservation  Service,  and  the 
National  Finance  Center. 
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Farmers  Home  Administration 


Probably  no  software  development  project  better  demon¬ 
strates  the  need  to  follow  good  software  management  principles 
than  FmHA's  Unified  Management  Information  System.  In  our 
1980  report  1/  we  concluded  that  the  UMIS  project  is  exper¬ 
iencing  extensive  delays  that  could  exceed  7  years  and  cost 
overruns  that  could  exceed  $25  million.  Details  on  how  our 
cost  estimates  were  calculated  are  included  in  our  1980  re¬ 
port.  It  should  be  pointed  out  that  this  estimate,  like  most 
estimates  in  this  chapter,  had  to  be  developed  by  us  because 
generally  USDA  and  the  agencies  we  reviewed  did  not  have  good 
cost  data  on  software  projects. 

FmHA  began  developing  UMIS  in  1974  to  replace  its  present 
accounting  and  information  system.  FmHA  determined  that  the 
present  system  was  obsolete  and  not  responsive  to  management's 
information  needs.  The  primary  objectives  of  UMIS  were  to 
provide  responsive,  timely,  and  useful  management  information 
to  all  levels  of  management  in  order  to  improve  service  to  rur¬ 
al  Americans  seeking  financial  assistance.  These  objectives 
have  not  been  met. 

We  have  issued  two  reports  (CED-78-68  and  CED-80-67,  sum¬ 
marized  in  app.  I)  concerning  FmHA's  problems  in  developing 
UMIS.  The  reports  showed  that  in  developing  UMIS,  FmHA  did  not 
properly  design,  document,  or  manage  the  project.  As  a  result, 
(1)  UMIS'  projected  implementation  date  is  5  to  7  years  later 
than  planned,  (2)  $17  million  and  6  years  of  effort  virtually 
have  been  wasted,  (3)  UMIS'  total  development  costs  could  reach 
$42  million,  (4)  the  operational  costs  of  UMIS,  as  designed, 
will  be  excessive,  and  (5)  the  system  may  not  meet  the  basic 
needs  for  which  it  is  being  developed. 

Since  FmHA  expected  UMIS  implementation  by  a  specified 
date,  it  relaxed  maintenance  on  its  present  information  and  ac¬ 
counting  system.  As  a  result,  the  system  contains  many  serious 
deficiencies.  For  example,  it  does  not  provide  adequate  and 
timely  data  for  sound  cash  management  decisions.  This  is  espe¬ 
cially  serious  considering  that  the  system  supports  the  manage¬ 
ment  of  FmHA's  multibillion  dollar  loan  portfolio. 

Since  FmHA  did  not  conduct  an  adequate  information  require¬ 
ments  analysis,  it  had  no  assurance  that  if  UMIS  became  opera¬ 
tional,  it  would  provide  needed  information  or  be  cost  effective. 
Also,  top  management  was  not  adequately  involved  in  making  crit¬ 
ical  decisions  required  throughout  the  design  and  development 


^/"Farmers  Home  Administration's  ADP  Development  Project — 
Current  Status  and  Unresolved  Problems"  (CED-80-67,  Feb.  19, 
1980). 
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phases.  Finally,  the  agency  did  not  assign  a  full-time  project 
manager  to  keep  the  project  on  track.  Consequently,  the  proj¬ 
ect  continued  for  6  years  without  the  benefit  of  effective 
management  controls  or  accountability  that  are  prerequisites 
for  successful  software  development  efforts,  especially  for  a 
project  of  UMIS 1  size  and  complexity. 

Because  of  the  serious  problems  FmHA  was  experiencing  in 
developing  UMIS,  the  Department  on  December  17,  1979,  withdrew 
FmHA's  approval  authority  for  this  project.  A  USDA  task  force 
was  then  established  to  review  the  technical,  accounting,  and 
user  information  requirements  as  well  as  the  organizational  and 
managerial  needs  for  the  project's  success.  In  addition,  a 
special  study  of  UMIS  was  ordered  by  the  new  Secretary  in  early 
1981.  A  final  decision  has  yet  to  be  made  regarding  actions  to 
correct  UMIS  management  problems. 

Agricultural  Stabilization  and  Conservation  Service 


The  requirement  to  follow  accepted  management  principles  is 
also  important  for  relatively  small  software  development  efforts. 
In  1978  ASCS  developed  the  peanut  sales  and  allotment  system  to 
meet  the  requirements  of  the  Food  and  Agriculture  Act  of  1977 
which  substantially  changed  the  price  support  and  marketing  quota 
programs  for  the  1978  and  subsequent  crops  of  peanuts.  ASCS 
estimated  the  system's  development  cost  at  $133,000  and  the  ann¬ 
ual  operating  costs  at  $130,000. 

As  with  FmHA,  ASCS  did  not  conduct  an  adequate  requirements 
analysis,  assign  a  full-time  project  manager,  or  monitor  and 
track  the  development  costs.  The  absence  of  these  essential  man¬ 
agement  practices  contributed  to  actual  development  costs  reaching 
$332,000  and  the  first  year's  operational  cost  exceeding  $681,000, 
or  more  than  five  times  the  amount  estimated.  (These  cost  esti¬ 
mates  were  provided  by  ASCS.)  Unlike  UMIS,  the  peanut  system  is 
operational  and  is  generally  meeting  user  requirements.  This, 
however,  has  required  extensive  and  costly  modifications  over  a 
2-year  period  after  the  system  was  implemented  because  of  inade¬ 
quate  user  requirements  analyses. 

ASCS  program  divisions  spent  about  5  months  determining  their 
information  requirements  before  deciding  to  develop  the  peanut 
system.  Even  so,  this  did  not  result  in  a  reasonable  definition 
of  the  divisions'  requirements.  During  system  development,  numer¬ 
ous  modifications  were  required  since  divisions  were  redefining 
their  requirements.  In  addition,  after  implementation,  the  system 
required  significant  and  costly  modifications  because  of  the  divi¬ 
sions'  earlier  inaccurate  requirements  analyses. 

National  Finance  Center 


In  our  review  we  examined  two  large  software  development 
projects  undertaken  by  NFC — the  redesign  of  USDA's  payroll/ 
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personnel  system  and  the  development  of  USDA's  central  account 
ing  system.  In  each  case  we  found  inadequate  project  plans 
and  controls  which  clearly  contributed  to  lengthy  schedule  de¬ 
lays  and  millions  of  dollars  in  cost  overruns. 


Payroll/personnel  system 


NFC's  redesign  and  reprograming  of  the  USDA  payroll/per¬ 
sonnel  system  will  not  be  completed  until  at  least  3-1/2  years 
later  than  planned  at  a  cost  overrun  of  more  than  $3.3  million. 
The  lack  of  consistent  planning,  coupled  with  project  managers 
who  were  not  given  sufficient  authority,  contributed  heavily  to 
project  delays  and  cost  overruns.  In  addition,  USDA  will  be 
relying  on  obsolete,  high-risk,  and  inefficient  computers  to 
process  the  biweekly  payroll  for  100,000-plus  USDA  employees. 


NFC  officials  decided  to  redesign  the  USDA  payroll/person¬ 
nel  system,  rather  than  only  convert  it,  to  take  advantage  of 
technical  advances  which  would  be  available  from  new  equipment 
being  procured.  Because  IBM  announced  it  would  discontinue 
full  maintenance  of  the  old  computers  supporting  the  existing 
system  by  December  1979,  NFC  made  that  date  its  target  for  the 
redesigned  system.  The  target  date  was  not  met,  and  NFC  found 
it  necessary  to  redefine  the  project  in  two  phases: 


— Phase  I,  or  "the  minimum  system,"  which  would  generate 
payroll  tapes  for  disbursing  centers  and  perform  other 
essential  functions. 


— Phase  II,  the  balance  of  the  system,  which  would  generate 
personnel  accounting  reports. 

NFC  considered  it  important  to  complete  phase  I  by  the  old  com¬ 
puters'  maintenance  deadline.  However,  NFC  now  estimates  that 
phase  I  will  be  implemented  by  October  1981  and  phase  II  by 
July  1983. 

NFC's  slippages  in  completing  the  redesign  will  conserva¬ 
tively  add  more  than  $3.3  million  to  total  project  costs.  NFC 
does  not  routinely  track  ADP  costs.  We  obtained  such  informa¬ 
tion  from  various  special  reports  and  officials'  estimates, 
filling  gaps  through  averaging  techniques  and  applying  past 
estimated  resource  costs.  Based  on  the  redesign  justification, 
recent  NFC  plans,  and  fragmented  information  on  expended  staff 
time,  we  estimated  the  staff  time  overrun  at  more  than  $547,000 
(unadjusted  for  salary  escalation).  Also  based  on  NFC  informa¬ 
tion,  we  estimated  that  operating  the  second-generation  equip¬ 
ment  from  the  original  completion  date  to  the  revised  completioi 
date  will  add  about  $2.7  million  to  the  cost.  This  estimate 
excludes  power,  cooling,  space,  and  indirect  labor  costs,  which 
were  not  reasonably  available.  Additionally,  NFC  incurred  cost 
of  more  than  $104,000  in  assuring  that  emergency  backup  would  t 
available  for  the  old  computers. 
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NFC  initially  developed  overall  project  plans  but  did  not 
continue  to  update  them  as  the  project  slipped.  Also,  NFC  did 
not  perform  the  detailed  planning  to  the  degree  necessary  to 
assure  that  resources  were  effectively  coordinated.  For  ex¬ 
ample,  the  same  programers/analysts  responsible  for  redesign 
tasks  were  also  heavily  involved  in  program  maintenance  and 
other  software  projects  without  the  establishment  of  clear 
priorities.  Detailed  plans  were  incomplete  or  out  of  date  and 
were  not  coordinated  into  a  comprehensive  document  until  we 
suggested  this  be  done. 

Until  late  in  the  project,  the  lack  of  effective  planning 
was  compounded  by  an  inadequate  progress  reporting  system. 

The  programers  reported  their  progress  to  an  independent  moni¬ 
tor  (see  below),  who  prepared  manual  reports  which  varied  in 
degree  of  quantitative  information  shown.  While  they  noted 
mounting  slippages  by  sometimes  analyzing  progress  on  major 
subsystems,  these  reports  did  not  adequately  demonstrate  the 
magnitude  of  the  problem.  An  August  1979  report  indicated  that 
phase  I  would  be  completed  no  earlier  than  April  1980.  In  Sep¬ 
tember,  the  NFC  Director  insisted  this  effort  would  be  completed 
in  April  1980;  however,  upon  performing  the  more  detailed  plan¬ 
ning  we  suggested,  NFC  found  phase  I  would  slip  6  additional 
months. 

After  we  explained  our  concerns,  the  Director  reemphasized 
the  priority  of  this  project,  reduced  unnecessary  maintenance, 
and  instituted  more  effective  planning  procedures.  The  program¬ 
ers  also  developed  an  automated  progress  reporting  system  which 
focused  management  attention  on  surfacing  problems.  We  believe 
these  actions  will  enhance  the  probability  that  the  project  will 
succeed  if  they  are  institutionalized. 

NFC  did  assign  project  managers  to  the  redesign  effort. 
However,  the  project  managers  functioned  more  as  project  monitors 
because  they  had  no  line  authority  over  a  number  of  persons  heav¬ 
ily  involved  in  the  redesign  effort.  For  example,  one  project 
manager  felt  obliged  to  approach  normal  line  supervisors  before 
directing  these  persons,  especially  to  shift  emphasis  from  main¬ 
tenance  activities  to  the  redesign.  On  at  least  one  occasion, 
this  problem  was  brought  to  top  management's  attention  but 
received  no  action. 

Central  accounting 

system  development  problems 

Developing  and  implementing  USDA's  central  accounting  sys¬ 
tem  (CAS)  is  expected  to  be  completed  more  than  10  years  after 
its  initial  target  date.  In  addition,  our  estimates  show  that 
the  costs  to  complete  development  of  CAS  may  exceed  initial 
planned  costs  by  about  $13.7  million.  Although  charged  with 
developing  CAS,  NFC  was  hindered  in  its  development  because  (1) 
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agency  resistance  forced  an  early  redefinition  of  the  project 
and  numerous  schedule  changes  and  (2)  a  Department  reorgani¬ 
zation  erased  much  of  the  project's  early  progress. 

Nonetheless,  the  management  of  this  project  was  inef¬ 
fective.  We  found  USDA  did  not  prepare  a  cost/benefit  analy¬ 
sis,  conduct  an  adequate  user  requirements  analysis  before 
developing  CAS,  or  maintain  project  cost  data.  Further,  NFC 
did  not  coordinate  with  USDA  agencies  the  development  of  com¬ 
prehensive  implementation  plans. 

NFC  has  neither  estimated  the  total  cost  of  this  project 
nor  accumulated  its  costs  to  date.  However,  based  on  the 
staff-year  estimates  of  NFC  officials,  we  estimated  that  the 
requirements  and  development  efforts  alone  have  exceeded  $8 
million  to  date  and  will  approach  $15  million  before  completion. 
The  $8  and  $15  million  were  our  calculations  based  on  NFC  mana¬ 
gers'  estimates  of  staff-years  spent  to  date  and  projected  time 
to  complete  the  project.  We  estimated  the  cost  per  staff-year 
based  on  data  on  hourly  rates  and  fringe  benefits  used  by  NFC 
as  justification  for  initiating  another  software  project.  We 
assumed  that  average  annual  staff-years  required  for  the  proj¬ 
ect  will  continue  at  the  same  level  as  in  the  past.  This 
estimate  does  not  include  the  very  significant  costs  of  user 
involvement  and  operation  of  duplicate  systems,  software  mainte¬ 
nance,  computer  resources,  indirect  labor,  and  cost  escalation. 
The  initial  project  plan  estimated  that  about  32  staff-years 
would  be  required,  which  should  have  totaled  less  than  $1.3 
million  based  on  NFC  data  on  cost  per  staff-year. 

The  development  of  CAS  was  mandated  by  Secretarial  memoran¬ 
dums  in  1972  and  1973.  The  original  objectives  of  CAS  were  to 
provide  uniform  agency  accounting  reports  and  to  bring  all  cov¬ 
ered  USDA  agencies  into  the  system  by  January  19~5.  These  ob¬ 
jectives  were  not  met.  Citing  different  management  needs,  USDA 
agencies  objected  strongly  to  the  uniformity  concept,  thereby 
forcing  NFC  to  develop  tailored  reports  for  each  agency  and  adopt 
a  gradual  implementation  strategy. 

Continued  agency  objections  to  CAS  and  a  departmental 
reorganization  resulted  in  additional  slippages,  and  full  imple¬ 
mentation  projections  were  changed  to  1985 — 10  years  later  than 
initially  planned.  In  1977  USDA  reorganized,  merging  some  agen¬ 
cies  or  staff  offices  which  had  been  implemented  onto  CAS  into 
agencies  which  had  not.  Consequently,  the  work  performed  for 
several  implemented  agencies  was  lost. 

Agencies  are  continuing  to  resist  or  refuse  to  join  CAS. 

One  agency,  scheduled  for  implementation  in  1981,  surveyed  other 
agencies'  satisfaction  with  CAS  services.  Based  on  its  find¬ 
ings,  it  refused  implementation.  We  did  not  attempt  to  verify 
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the  agencies'  complaints  regarding  late  or  inaccurate  reports. 

A  1980  Office  of  Inspector  General  report,  however,  confirmed 
that  agencies  lacked  confidence  in  CAS  reports. 

We  believe  agency  resistance  to  CAS  may  have  been  mitigated 
by  (1)  a  cost/benefit  study  and  (2)  an  adequate  user  require¬ 
ments  analysis  for  the  entire  system.  A  cost/benefit  study 
could  have  demonstrated  the  benefits  of  joining  CAS.  Converse¬ 
ly,  the  study  could  have  demonstrated  to  USDA  top  management 
that  it  was  not  cost/beneficial  to  develop  CAS. 

More  extensive  agency  involvement  in  developing  implemen¬ 
tation  plans  to  join  CAS  might  have  alleviated  agencies'  recent 
resistance.  Agencies  scheduled  to  join  CAS  in  succeeding  years 
were  identified  on  NFC  project  sheets  before  NFC  obtained  their 
firm  commitment.  Rather,  NFC  obtained  written  agreements  from 
the  agencies  just  prior  to  the  time  it  began  detailed  require¬ 
ments  and  development  work  for  them. 

The  CAS  development  project  has  taken  far  longer  than  and 
bears  little  conceptual  similarity  to  the  system  described  in 
the  Secretary's  memorandums.  Because  of  the  changes'  in  tech¬ 
nology,  organization,  and  management  requirements  which  have 
occurred  over  this  extended  development  period,  USDA  should  con¬ 
sider  suspending  further  development  until  a  comprehensive  re¬ 
examination  of  the  concept,  cost,  and  benefits  is  performed.  If 
the  study  demonstrates  the  concept  is  viable,  agency  resistance 
could  be  mitigated. 

MORE  TOP  MANAGEMENT  INVOLVEMENT 
AND  PLANNING  NEEDED  IN  AGENCIES' 

CONVERSION  EFFORTS 


Because  of  computer  upgrades  at  USDA  computer  centers  in 
1977  and  1978,  USDA  agencies  found  it  necessary  to  devote 
considerable  time  and  resources  to  convert  applications  software 
to  new  computer  systems.  Not  all  these  conversion  efforts, 
however,  were  initiated  with  comprehensive  plans,  adequate  top 
management  involvement,  and  full-time  project  managers.  Conse¬ 
quently,  lengthy  delays  occurred  which  resulted  in  substantial 
dual  computer  operations  cost  and  continued  use  of  obsolete  and 
high-risk  computer  equipment.  Conversion  problems  of  the  USDA 
National  Finance  Center  and  the  Agricultural  Stabilization  and 
Conservation  Service  follow. 

National  Finance  Center 


For  several  reasons,  including  inadequate  planning  and 
project  management,  NFC's  conversion  of  most  existing  software 
applications  to  new  computers  will  greatly  exceed  time  and  cost 
estimates.  Planned  for  completion  during  fiscal  year  1979, 
conversion  probably  will  not  be  completed  until  1983  at  a  cost 
overrun  which  we  estimate  at  about  $6.8  million. 


In  1978  NFC  competitively  acquired  a  Honeywell  66/80  sys¬ 
tem  to  replace  its  second-  and  third-generation  IBM  computers. 
USDA's  initial  strategy  was  to  use  a  contractor  to  convert  most 
of  NFC's  application  software  to  the  new  computer.  NFC,  how¬ 
ever,  prepared  an  analysis  which  showed  it  would  be  more  cost 
effective  to  convert  these  applications  in-house.  NFC's  in- 
house  conversion  efforts  began  about  June  1978,  but  were  halted 
a  year  later.  Only  296  of  NFC's  1,100  initial  applications  had 
been  converted  when  the  effort  was  halted. 

NFC's  decision  to  perform  the  conversion  in-house  was 
based  on  an  analysis  which  did  not  adequately  consider  overall 
staff  availability  in  relation  to  other  NFC  projects  such  as 
the  CAS  development  and  the  payroll/personnel  system  redesign. 

The  analysis  showed  that  the  in-house  alternative  would  require 
only  about  2  staff-years  more  than  required  to  support  a  con¬ 
tractor  conversion  effort;  therefore,  it  appeared  cost  effective 
to  avoid  the  contract  price  of  more  than  $700,000.  Our  analysis, 
however,  shows  NFC  probably  did  not  have  sufficient  uncommitted 
staff-years  because  of  staff  requirements  for  the  other  NFC 
software  activities. 

In  addition  to  a  questionable  analysis,  NFC's  in-house 
conversion  effort  did  not  include  a  relevant  conversion  plan. 
NFC's  conversion  plan  was  only  a  list  of  application  programs 
that  were  to  be  furnished  to  a  contractor.  These  lists  did  not 
show  detailed  time  estimates  or  consider  existing  staff  commit¬ 
ments.  That  is,  the  same  staff  committed  to  the  in-house  con¬ 
version  effort  were  also  committed  to  the  massive  payroll/person¬ 
nel  system  redesign  and  CAS  efforts.  In  addition,  the  lack  of 
planning  was  compounded  by  an  ineffective  system  for  tracking 
conversion  progress. 

Conversion  postponed  for  questionable  reasons 

About  a  year  after  it  began,  the  Director  of  NFC  indefin¬ 
itely  halted  the  conversion  effort  because  of 

— technical  problems  with  the  new  Honeywell  computer, 

— doubts  about  the  capacity  of  the  new  computer,  and 

— the  need  to  devote  more  staff  time  to  the  slipping 
payroll/personnel  system  redesign  effort. 

We  believe  these  reasons  were  not  a  valid  basis  for  deferring 
project  completion  until  the  end  of  fiscal  year  1983,  as  cur¬ 
rently  planned.  We  concur  that  more  emphasis  was  needed  in  the 
payroll  redesign  effort  but  believe  some  resources  for  conver¬ 
sion  could  also  have  been  redirected  from  less  beneficial  proj¬ 
ects  and  unessential  maintenance.  Further,  the  technical  prob¬ 
lems  influencing  conversion  were  reportedly  soon  overcome,  and 
there  was  little  support  for  the  computer  capacity  fears.  More¬ 
over,  conversion  is  a  phased  process;  as  systems  were  converted 
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for  use  on  the  new  computer,  the  impact  could  have  been  assessed. 
Sufficient  lead  time  would  have  been  available  to  justify  and 
procure  additional  computer  capacity  if  necessary. 

Conversion  cost  overrun 

Rather  than  saving  $604,000  as  USDA  testified  in  1980 
appropriations  hearings,  we  estimated  that  NFC  will  spend  at 
least  $6.2  million  more  by  performing  the  conversion  itself  than 
would  have  been  spent  in  contracting  it  out.  Almost  $5.9  mil¬ 
lion  of  this  total  overrun  resulted  from  extended  operation  of 
the  old  computer  from  the  time  conversion  should  have  been  com¬ 
pleted. 

Calculating  the  cost  of  NFC's  conversion  cost  overrun  was 
complex.  (The  following  explanation  is  only  a  general  state¬ 
ment  of  our  methodology. )  Our  estimate  included  the  cost  of  ex¬ 
tended  operation  of  the  old  computer  and  the  cost  overrun  on 
programer  labor.  Our  estimate  of  the  monthly  cost  (about 
$120,000)  to  operate  the  computer  equipment  until  released  was 
calculated  based  on  information  provided  by  NFC  which  covered  per¬ 
sonnel  cost,  equipment  rental  and  maintenance,  space,  and  power. 
The  conversion  was  originally  planned  for  completion  about  July 
1979,  but  later  NFC  revised  this  to  September  1983,  a  slippage 
of  50  months.  Our  estimate  for  extended  operation  came  to  about 
$5.9  million.  In  addition,  we  estimated  that  there  will  be  an 
overrun  on  programer  labor  which  will  amount  to  about  $900,000. 

NFC  officials  indicated  that  our  estimates  of  cost  overruns 
on  its  software  projects  appeared  high.  However,  NFC  does  not 
track  software  project  costs  and  did  not  provide  us  with  its  esti¬ 
mates  of  actual  project  costs.  Therefore,  we  had  no  reason  to 
change  our  cost  estimates. 

Agricultural  Stabilization  and  Conservation  Service 


Because  of  inadequate  planning,  top  management  involvement, 
and  procedures  to  monitor  progress,  ASCS  Kansas  City  Commodity 
Office's  conversion  efforts  floundered  for  3-1/2  years  with  lit¬ 
tle  progress  made.  Scheduled  for  completion  in  June  1981,  it  ap¬ 
pears  conversion  will  be  delayed  until  1983  or  later.  Conse¬ 
quently,  the  Department's  Kansas  City  Computer  Center  must  con¬ 
tinue  to  operate  a  redundant  computer  system  through  this  period 
at  additional  costs  estimated  at  about  $1  million.  Furthermore, 
in  order  to  manage  grain  inventories  valued  at  $1.43  billion, 

ASCS  must  continue  to  rely  on  an  inventory  system  which  was  con¬ 
sidered  obsolete  and  inefficient  in  1977. 

From  May  1977  through  December  1979,  the  Commodity  Office 
pursued  the  following  approaches  to  convert  and/or  redesign  its 
two  major  inventory  systems,  the  processed  commodity  inventory 
system  and  the  grain  inventory  system: 

— Use  a  commercial  vendor  to  convert  both  systems. 
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--Convert  both  systems  "as  is"  using  in-house  personnel. 

— Develop  a  new  inventory  system  to  replace  both  systems. 

--Redesign  only  the  grain  inventory  system  and  convert  the 
processed  commodity  inventory  system. 

None  of  these  approaches,  however,  included  (1)  comprehensive  proj¬ 
ect  plans  with  milestone  dates,  (2)  provision  for  full-time  project 
managers,  and  (3)  procedures  to  monitor  and  report  progress. 
Accordingly,  ASCS  top  management's  knowledge  of  these  efforts  was 
inadequate  for  monitoring  and  control  purposes. 

In  December  1979  the  ASCS  Deputy  Administrator  for  Commodity 
Operations  directed  the  Commodity  Office  to  prepare  a  comprehen¬ 
sive  project  plan,  assign  a  full-time  project  manager,  and  submit 
monthly  progress  reports.  In  May  1980  the  Deputy  Administrator 
finally  recognized  after  3  years  that  the  Commodity  Office  was 
not  progressing  in  its  latest  conversion/redesign  effort.  As  a 
result,  ASCS  top  management  directed  the  Commodity  Office  to 
contract  out  the  conversion  of  its  grain  i nventory ^system. 

« 

Meanwhile,  the  Commodity  Office  succeeded  in  moving  its 
processed  commodity  inventory  system  to  a  new  computer  system. 
Nevertheless,  this  inventory  system  still  needs  to  be  converted 
to  a  standard  computer  programing  language. 

In  November  1980  ASCS  issued  a  request  for  proposal  for  the 
conversion  of  the  grain  inventory  system.  In  February  1981, 
however,  ASCS  suspended  its  contractual  efforts  because  the  ven¬ 
dors'  bids  were  considerably  higher  than  expected.  The  Commodity 
Office's  present  plan  is  again  to  redesign  the  grain  inventory 
system  in-house.  This  latest  approach  is  not  expected  to  be 
completed  until  1983  or  later. 

While  the  Commodity  Office  is  again  attempting  to  redesign 
its  grain  inventory  system,  the  Kansas  City  Computer  Center  must 
continue  to  operate  both  a  Honeywell  and  an  IBM  computer  system. 

The  Honeywell  system  was  acquired  in  1978  to  replace  the  center's 
older  IBM  system  and  to  provide  hardware  support  to  the  Commodity 
Office's  inventory  systems.  USDA,  however,  cannot  release  the 
IBM  equipment  until  the  Commodity  Office  completes  the  conversion 
of  the  grain  inventory  system.  Consequently,  the  center  must 
operate  both  the  Honeywell  system,  which  is  underutilized,  and  the 
IBM  system  through  1983,  or  2-1/2  years  longer  than  originally 
planned,  at  an  additional  cost  estimated  by  us  at  more  than 
$1  million.  Our  estimate  is  based  on  a  1980  analysis  prepared  by 
the  Kansas  City  Computer  Center  of  the  cost  to  operate  the  IBM 
system  over  a  3-year  period.  We  calculated  the  cost  to  operate 
the  computer  over  a  2-1/2-year  period  by  assuming  operating  costs 
would  be  constant  over  this  period  and  reducing  the  center's  data 
by  one-sixth. 
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AGENCIES  ARE  NOT  DEVELOPING  AND 
REPORTING  LIFE-CYCLE  COSTS  FOR 
APPLICATIONS  SOFTWARE  SYSTEMS 

USDA  agencies  included  in  our  review  were  not  fully  estimat¬ 
ing,  developing,  or  reporting  life-cycle  costs  for  their  applica¬ 
tions  software  systems,  although  the  Forest  Service  is  developing 
a  life-cyle  approach.  Without  life-cycle  cost  data,  agency  top 
management  cannot  adequately  evaluate  the  reasonableness  of  costs 
for  applications  software  activities. 

OMB  Circular  A-109  defines  life-cycle  cost  as  the  sum  total 
of  the  direct,  indirect,  recurring,  nonrecurring,  and  other  re¬ 
lated  costs  incurred,  or  estimated  to  be  incurred,  in  the  design, 
development,  production,  operation,  maintenance,  and  support  of 
a  major  system  over  its  anticipated  useful  life  span. 

With  life-cycle  cost  information,  top  management  has  better 
cognizance  and  control  over  agencies'  ADP  operations.  Accordingly, 
managers  can  make  more  timely  and  informed  decisions  to  avoid  pro¬ 
longed  development  cycles,  extensive  cost  growth  (actual  costs 
exceeding  estimated  costs),  and  deficient  and  unnecessarily 
expensive  ADP  operations. 

UMIS  management  hindered  by  lack  of  cost  data 

The  importance  of  developing  and  tracking  life-cycle  costs 
is  demonstrated  by  the  problems  FmHA  had  in  developing  UMIS. 

Before  beginning  its  development,  FmHA  did  not  prepare  cost  esti¬ 
mates  to  develop  and  operate  UMIS.  It  also  did  not  use  a  project 
control  and  cost  system  to  track  and  review  each  stage  of  system 
development.  As  a  result,  FmHA  could  not  accurately  provide 
information  on  (1)  UMIS'  actual  development  costs,  (2)  estimated 
costs  to  complete  development,  and  (3)  estimated  costs  to  operate 
or  maintain  the  system.  We  believe  this  lack  of  adequate  cost 
data  seriously  reduced  UMIS  managers'  ability  to  plan  and  control 
the  system's  development. 

NFC  billings  to  users  do  not 
include  fair  share  of  software  costs 


Some  agencies  pay  disproportionately  for  NFC  services  because 
the  center  does  not  identify  or  appropriately  charge  out  software 
costs.  In  its  efforts  to  complete  the  centralization  of  payments, 
collections,  and  accounting  systems  for  the  Department,  NFC  has 
spent  millions  of  dollars  for  software  development  and  operation. 
The  extent  of  such  software  work  may  vary  substantially  from  agency 
to  agency,  especially  in  the  case  of  the  central  accounting  system. 
However,  NFC  bills  nearly  all  of  its  overall  costs  to  user  agencies 
based  simply  on  input  transactions — for  example,  vendor  invoices, 
travel  vouchers,  and  accounting  entries,  which  are  not  necessarily 
related  to  ADP  costs  incurred.  As  a  result,  elaborate  software 


systems  developed  and  operated  by  NFC  for  some  agencies  are 
subsidized  by  agencies  with  less-extensive  ADP  needs. 

To  properly  charge  agencies,  NFC  must  begin  tracking  ADP  costs. 
Although  we  found  that  ADP  costs  represent  an  estimated  39  percent 
of  its  budget,  NFC  does  not  attempt  to  track  the  costs  of  operat¬ 
ing  computer  resources,  developing  software  systems,  and  maintain¬ 
ing  existing  software.  Sometimes  NFC  establishes  target  costs 
or  projected  savings  for  large  software  projects,  but  it  does 
not  attempt  to  measure  its  performance  against  these  goals. 

Our  "Guidelines  for  Accounting  for  Automatic  Data  Processing 
Costs"  (1978)  recommends  that  all  agencies  account  for  such  costs 
in  ways  useful  for  management,  budgeting,  and  external  reporting. 

In  September  1980  OMB  issued  Circular  A-121  which,  among  other 
things,  requires  agencies  to  account  for  the  full  cost  of  operat¬ 
ing  data  processing  facilities,  including  costs  of  software 
development.  However,  NFC  believes  it  is  exempt  because  the  OMB 
requirement  applies  only  to  computer  centers  which  support  multiple 
users.  While  NFC  may  be  the  only  direct  user,  it  charges  out 
all  its  operating  costs  to  USDA  agencies.  We  believe  properly 
accounting  for  ADP  resources  is  fundamental  to  effective  manage¬ 
ment  and  NFC  and  USDA  agencies  would  benefit  if  NFC  followed 
our  guidelines  and  the  OMB  circular. 

SOFTWARE  MAINTENANCE  IS  A  COSTLY 
ACTIVITY  NOT  BEING  CONTROLLED 

USDA  does  not  accumulate  cost  data  on  total  software  costs 
or  on  software  maintenance.  The  Director  of  the  General  Serv¬ 
ices  Administration's  Software  Development  Center  recently 
told  us  that  software  maintenance  costs  the  Federal  Government 
at  least  $1.3  billion  per  year,  or  about  22  percent  of  the  total 
estimated  software  costs  of  $6  billion.  Applying  this  percentage 
to  our  earlier  $105  million  estimate  for  total  USDA  software 
costs,  we  estimate  USDA's  fiscal  year  1981  cost  for  software 
maintenance  at  $23  million.  This  is  a  very  conservative  esti¬ 
mate.  Our  discussions  with  Forest  Service,  ASCS,  and  NFC  ADP 
officials  indicated  that  actual  maintenance  costs  are  much  higher. 
The  Department,  however,  has  not  established  formal  policies  or 
procedures  to  control  and  cost  software  maintenance  activities. 
Consequently,  USDA  top  management  has  limited  overview  of  soft¬ 
ware  maintenance  activities  and  associated  costs. 

Software  maintenance  is  work  performed  on  application  soft¬ 
ware  after  it  is  placed  into  operation  either  to  make  it  do  more 
or  different  tasks,  to  remove  errors,  or  to  reduce  operating 
costs.  These  maintenance  activities  are  commonly  referred  to  as 
enhancements,  modifications,  or  optimizations. 


43 


Our  recent  software  maintenance  report  1/  showed  that  Federal 
agencies  generally  are  not  managing  or  controlling  software 
maintenance.  Further,  the  agencies  generally  are  not  accumulating 
or  tracking  software  maintenance  cost  data.  We  found  these  con¬ 
ditions  at  NFC  and  at  the  ASCS  Management  Field  Office.  At  NFC, 
the  Director  acknowledged  placing  too  much  emphasis  on  unnecessary 
software  maintenance  at.  the  expense  of  other  software  projects. 

NFC  is  implementing  a  system  to  manage  software  maintenance;  how¬ 
ever,  the  system  does  not  accumulate  or  track  cost  data.  The  ASCS 
Management  Field  Office  also  devotes  considerable  resources  to 
software  maintenance.  A  Field  Office  official  estimated  that  75 
percent  of  the  office's  programers/system  analysts'  efforts  are 
directed  toward  software  maintenance.  Nevertheless,  the  Field 
Office  does  not  properly  manage  or  control  these  efforts.  For 
example,  requests  for  modifications/enhancements  generally  are 
not  formally  approved,  documented,  or  costed. 

Because  of  these  weaknesses  in  managing,  controlling,  and 
costing  software  maintenance,  USDA  needs  to  establish  formal 
policies  and  procedures  for  this  high-cost  activity.  With  formal 
controls,  USDA  can  minimize  unnecessary  software  maintenance. 

NEED  FOR  TOP  MANAGEMENT  ASSISTANCE 


Effective  planning  and  management  control  are  necessary  if 
USDA  agencies  are  to  obtain  effective  and  efficient,  use  of  the 
over  $100  million  they  spend  annually  on  ADP  software  applica¬ 
tions,  conversions,  and  maintenance.  Because  of  the  cost  of 
ADP  systems  and  their  importance  throughout  USDA,  top  management, 
must  be  properly  involved  in  major  software  projects  from  plan¬ 
ning  through  implementation. 

In  our  recent  report,  "Government-Wide  Guidelines  and 
Management  Assistance  Center  Needed  To  Improve  ADP  Systems  Devel¬ 
opment"  (AFMD-81-20,  Feb.  20,  1981),  we  noted  that  management 
deficiencies  and  resulting  software  problems  have  cost  Federal 
agencies  much  money,  time,  and  effort.  We  pointed  out.  that.  Fed¬ 
eral  agencies  have  failed  many  times  in  developing  large,  com¬ 
plex  ADP  systems  because  they  have  neither  the  proper  guidance 
nor  the  necessary  assistance  from  top  management.  We  stated 
that  some  Federal  agencies  do  not  have  (1)  sufficient  and  effec¬ 
tive  top  management  involvement,  and  direction  and  (2)  a  strong 
central  office  to  facilitate  agencywide  planning,  coordination, 
and  control  of  ADP  resources.  We  recognized  that  agency  man¬ 
agers  accept,  the  need  to  exercise  greater  control  over  data 
processing  but.  are  handicapped  by  their  unfamiliarity  with  the 
technical  aspects  and  related  problems  of  ADP.  Thus  we  recom¬ 
mended  that  a  management,  assistance  center  be  established  to 
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assist  agency  top  management  in  planning,  designing,  acquiring, 
and  evaluating  laige,  complex  ADP  systems  development  projects. 

Our  evaluation  of  USDA's  management  of  software  projects 
shows  that  its  problems  and  weaknesses  are  similar  to  those  we 
have  identified  throughout  the  Government.  Based  on  its  agen¬ 
cies'  need  for  management  assistance,  its  size,  and  the  im¬ 
portance  of  software  to  its  programs,  we  believe  that  USDA 
should  establish  its  own  technical  assistance  center  modeled 
after  the  Government-wide  center  recommended  in  our  report. 

USDA's  center  would 

— assist  agencies  in  planning,  designing,  and  acquiring 
ADP  systems; 

—  independently  review  and  evaluate  agency  ADP  plans  and 
system  development  plans,  designs,  and  projects; 

— provide  independent  assessments,  suggest  alternatives, 
and  validate  requirements  and  economic  analyses  for 
major  information  system  budget  and  acquisition 
proposals;  and 

— develop  standards,  guidelines,  and  policy  options,  as  well 
as  develop  new  and  innovative  prototype  applications  of 
ADP  and  data  communication  technology. 

CONCLUSIONS 

In  developing,  converting,  and  maintaining  ADP  systems, 
sound  management  principles  must  be  followed  to  ensure  success — 
ADP  systems  that  are  cost  effective,  meet  user  needs,  and  meet 
cost  and  time  limits.  At  three  USDA  agencies  we  identified  mil¬ 
lions  of  dollars  in  estimated  cost  overruns  and  delays  of  up  to 
10  years  in  developing  new  ADP  systems  and  converting  old  systems 
to  modern  equipment.  These  USDA  agencies  are  not  following  ac¬ 
cepted  management  principles  required  to  effectively  monitor, 
plan,  and  control  their  software  projects.  The  projects  lacked 
adequate  management  oversight,  planning,  and  control  because 
agencies  did  not  assign  full-time  project  managers  and  use  ef¬ 
fective  control  techniques  such  as  (I)  establishing  milestone 
dates,  (2)  monitoring  progress  and  comparing  established  mile¬ 
stones  and  dates  at  selected  intervals,  (3)  developing  and 
tracking  life-cycle  costs,  or  (4)  controlling  maintenance 
activities . 

The  Department's  central  ADP  office's  oversight  over  agency 
software  projects  is  inadequate.  Because  of  inadequate  over¬ 
sight,  the  central  ADP  office  cannot  ensure  the  effective  and 
efficient  development  and  use  of  USDA’s  software  systems. 
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It  is  also  apparent  that  some  agencies  lack  the  managerial 
and  technical  expertise  to  complete  software  projects  on  time  and 
within  budgets.  A  Department  management  assistance  center  to 
provide  assistance  to  USDA  agencies  would  help  improve  software 
efforts . 

RECOMMENDATIONS  TO  THE 
SECRETARY  OF  AGRICULTURE 


We  recommend  that  the  Secretary  provide  the  senior  official 
with  clear  authority  over  agency  software  projects.  This  author¬ 
ity  would  require  agencies  to  submit  to  the  senior  official  the 
following  documents  and  data  for  software  projects  meeting 
established  dollar  thresholds: 

— Feasibility  studies,  cost/benefit  analyses,  and  user 
requirements  analyses. 

— Comprehensive  project  plans  that  include  milestones  and 
dates  and  identify  project  managers. 

— Procedures  that  will  be  used  to  monitor  the  project's 
progress  and  track  its  costs. 

— Progress  reports  showing  percent  of  completion  and 
costs  to  date,  and  estimated  time  and  cost  to  complete 
the  project. 

We  recommend  that  the  Secretary  establish,  under  the  direc¬ 
tion  of  the  senior  official,  a  management  assistance  center  for 
computer  software  and  systems  development. 

We  recommend  that  the  Secretary  direct  the  senior  official 
to  establish  formal  procedures  and  policies  for  software  main¬ 
tenance  activities  and  for  life-cycle  ADP  cost  accounting. 


CHAPTER  4 


STRONG  MANAGEMENT  CONTROL  NEEDED 
FOR  MORE  EFFECTIVE  AND  EFFICIENT 
COMPUTER  CENTER  OPERATIONS 

USDA's  five  departmental  computer  centers  operating  in 
Washington,  Fort  Collins,  Kansas  City,  St.  Louis,  and  New  Orleans 
are  not  effectively  and  efficiently  managed.  One  or  more  of  the 
centers  have  experienced  problems  with  (1)  providing  users  with 
consistent,  quality  service,  (2)  using  computer  resources 
efficiently,  (3)  receiving  adequate  workload  forecasts  from 
agencies,  (4)  retaining  obsolete  equipment  longer  than  planned, 
and  (5)  preparing  accurate  and  useful  information  on  capacity, 
performance,  and  service  levels. 

Data  Service's  typical  approach  in  dealing  with  user  dis¬ 
satisfaction  is  to  acquire  more  computer  hardware.  Other  alter¬ 
natives  need  to  be  emphasized  including  efforts  to  better  utilize 
existing  ADP  resources  and  improve  forecasting  of  future  require¬ 
ments.  Such  efforts  will  require  USDA  to  develop  a  program  for 
evaluating  and  managing  the  performance  of  its  large  computer 
centers.  Stronger  management  control  is  also  needed  to  ensure 
that  agencies  use  the  centers'  computer  resources  more  efficiently 
and  prepare  meaningful  workload  forecasts. 

In  addition  to  the  overall  management  issues,  the  House 
Government  Operations  Committee  has  been  concerned  about  the  man¬ 
agement  of  the  New  Orleans  computer  facility  since  its  takeover 
by  NFC  in  1977.  In  the  early  1970s  USDA's  computer  centers  were 
consolidated  and  put  under  centralized  management  because  a  study 
had  found  that  proliferation  of  single-agency  computers  was  waste¬ 
ful  and  ineffective.  Consequently,  we  believe  that  before  an 
agency  acquires  control  over  a  large-scale  computer  facility,  (1) 
the  agency  should  economically  justify  such  a  decision  and  (2) 
computer  center  operations  should  be  periodically  reviewed  to 
ensure  efficient  and  effective  use  of  center  resources.  These 
steps  were  not  performed  with  the  New  Orleans  computer  facility. 

PROGRAM  NEEDED  TO  MEASURE 
AND  ASSESS  COMPUTER  PERFORMANCE 

A  formally  structured  program  providing  accurate,  quantita¬ 
tive,  and  well-documented  information  on  performance  and  capacity 
is  an  effective  method  for  managing  computer  resources.  Such  a 
program  is  usually  referred  to  as  a  computer  performance  manage¬ 
ment  ( CPM)  program. 

The  need  for  a  progam  like  CPM  was  recognized  by  the  Fed¬ 
eral  Government  in  1977  when  the  National  Bureau  of  Standards 
published  Federal  Information  Processing  Standards  Publication 
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49,  "Guideline  on  Computer  Performance  Management:  An  Introduc¬ 
tion."  1/  This  publication  defines  a  CPM  program  as  "any  struc¬ 
tured  effort  *  *  *  to  measure  and  evaluate  the  performance  of  a 
computer  facility  in  support  of  established  management  goals  and 
objectives. " 

The  General  Services  Administration  has  also  recognized  the 
need  for  developing  such  programs.  In  November  1978  GSA  published 
a  very  detailed  document  entitled  "Management  Guidance  for  Develop¬ 
ing  and  Installing  an  ADP  Performance  Management  Program. "  These 
publications  are  only  two  of  many  that  provide  guidance  on  the  use 
of  programs  to  manage  computer  centers'  performance  and  capacity. 

"The  EDP  Performance  Management  Handbook,"  2/  published  by 
Applied  Computer  Research,  describes  CPM  as  a  process  for  (1) 
negotiating  service  level  objectives  between  data  processing  and 
its  users,  (2)  tracking  actual  service  levels  provided  users,  and 
(3)  "tuning"  the  data  processing  organization  until  objectives  are 
met.  The  definition  also  suggests  capacity  planning  for  equipment 
and  staff  to  meet  established  service  level  objectives. 

A  principal  function  of  CPM  is  optimizing  the  use  of  system 
resources.  This  includes  tuning  software,  configuring  the  equip¬ 
ment,  allocating  resources,  determining  the  capacity  of  the  compo¬ 
nents  individually  and  collectively,  setting  standards  for  perform¬ 
ance,  providing  guidelines  for  more  efficient  use  of  resources, 
and  using  appropriate  tools  and  techniques  for  measuring  and 
evaluating  system  performance.  These  actions  should  result  in 
more  cost-effective  use  of  equipment,  better  use  of  personnel,  and 
increased  capacity. 

Although  Data  Services  has  established  some  elements  of  a  CPM 
program,  these  elements  have  not  been  effectively  consolidated  nor 
have  reports  been  useful  to  top  management.  An  effective  CPM  pro¬ 
gram  could  improve  service  to  users  and  increase  the  efficiency  of 
computer  center  operations. 

CAPACITY  PROBLEMS  HINDER 
COMPUTER  CENTERS'  ABILITY  TO 
PROVIDE  CONSISTENT,  QUALITY  SERVICE 

Users  of  USDA  computer  centers  generally  have  expressed 
dissatisfaction  with  the  centers'  computer  systems'  availability. 


1/The  Federal  Information  Processing  Standards  Publication  Series 
of  the  National  Bureau  of  Standards  is  the  official  publication 
relating  to  ADP  standards  adopted  and  promulgated  under  the 
provisions  of  Public  Law  89-306  (Brooks  Act). 

2/In  private  industry  electronic  data  processing  (EDP)  is  usually 
used  rather  than  automatic  data  processing  (ADP) ,  which  is  used 
in  the  Federal  Government. 
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accessibility,  turnaround,  and  response  time.  The  computer 
centers  have  not  consistently  met  users'  expectations  and  infor¬ 
mation  needs.  The  centers  have  had  continual  problems  in  meeting 
these  needs  and  are  not  efficiently  using  available  capacity.  1/ 
To  solve  these  problems.  Data  Services  continues  to  acquire  more 
equipment. 

Capacity  problems  at  individual  computer  centers  are 
discussed  below. 

Fort  Collins  Computer  Center 

Since  its  opening  in  February  1974,  FCCC  has  incurred 
computer  capacity  problems.  By  March  1975  workload  capacity  on 
the  UNIVAC  1108  equipment  had  reached  a  saturation  level,  and 
not  until  September  1976  was  the  computer  replaced  with  a  newer, 
more  capacious  UNIVAC  1100/42.  This  computer  capacity  was  ex¬ 
panded  in  late  1978  and  replaced  in  September  1979  with  a  UNIVAC 
1100/82.  Although  the  new  UNIVAC  1100/82  was  intended  to  have 
a  6-year  life,  the  computer  was  upgraded  sooner  than  expected. 
FCJC  upgraded  the  UNIVAC  computer  to  an  1100/83  in  April  1980. 

Forest  Service's  access  of  the  computer  system  at  FCCC  has 
been  inadequate.  For  example,  according  to  statistics  provided 
by  the  communications  supplier,  users  attempted  to  access  FCCC 
249,479  times  in  January  1980  but  were  successful  only  19,035 
times.  The  problem  was  caused  by  an  expanded  use  of  remote 
terminals  in  the  Forest  Service  and  an  inadequate  number  of 
ports.  Users  of  remote  terminals  gain  access  to  the  computer 
through  communication  ports  maintained  by  the  center.  The 
number  of  ports  limits  the  number  of  terminals  that  can  simul¬ 
taneously  access  the  computer. 

Kansas  City  Computer  Center 

This  center  has  the  capacity  to  serve  users'  needs  24  hours 
a  day,  but  the  computer  is  used  essentially  during  prime  time 
(8  a.m.  to  4  p.m. )  and  only  on  a  limited  basis  between  4  p.m. 
and  8  a.m.  Even  though  user  organizations  are  not  using  this 
available  computer  time,  they  are  concerned  about  the  lack  of 
adequate  KCCC  capacity  for  prime-time  hours. 

St.  Louis  Computer  Center 

Because  of  delays  in  developing  UMIS,  coupled  with  increas¬ 
ing  FmHA  workload  and  the  impact  of  new  projects,  the  current 
Burroughs  computers  must  be  maintained  longer  than  planned. 


1/The  capacity  (power)  of  a  computer  system  is  defined  as  the 
maximum  rate  the  system  can  perform  work.  The  efficiency  with 
which  this  system's  capacity  is  applied  determines  the  level 
of  service  for  its  users. 
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Based  on  SLCC  data,  these  computers  are  also  nearing  capacity 
and  are  experiencing  downtime  problems.  Moreover,  the  signifi¬ 
cant  delays  in  completing  UMIS  or  its  replacement  information 
system  result  in  additional  costs  to  continue  operating  SLCC. 

USDA  planned  to  discontinue  the  computer  center  operation  in  1979. 
The  Kansas  City  Computer  Center  was  established  in  1978  and  pur¬ 
chased  equipment  to  support  UMIS  when  it  was  completed.  Since 
SLCC  continues  to  operate  its  own  computer  systems,  cost  savings 
will  not  be  realized  as  planned. 

Washington  Computer  Center 

Based  on  our  discussions  with  users,  we  found  that  they 
were  satisfied  with  WCC's  batch  processing  turnaround  time  but 
not  with  the  slow  response  to  transactions  entered  through  com¬ 
puter  terminals.  Some  monitoring  of  the  computer  system  perform¬ 
ance  has  occurred  to  assure  that  it  was  continuing  to  operate 
efficiently.  However,  users'  needs  for  software  maintenance  and 
developmental  work  exceeded  available  capacity. 

National  Finance  Center 


NFC's  Honeywell  66/80  computer  system  now  has  two  central 
processing  units.  NFC  management  believes  more  capacity  will 
be  needed  to  process  an  increasing  workload  generated  by  new  and 
expanded  application  software  projects.  Also,  capacity  may  be 
strained  as  the  existing  workload  on  older  IBM  7080  and  360  com¬ 
puters  is  transferred  to  the  more  modern  Honeywell  computer 
system. 

Data  Services  approach  is  to 
buy  more  equipment 

In  order  to  ease  these  capacity  problems  at  the  computer 
centers.  Data  Services'  approach  has  been  to  buy  more  equipment. 
Near  the  completion  of  our  field  work,  the  Department  acquired 
or  planned  to  acquire  computers  at  all  five  computer  centers. 

— In  early  1981  FCCC  acquired  an  additional  CPU  for  its 
UNIVAC  computer  system.  This  acquisition  occurred  sooner 
than  planned.  In  addition,  FCCC  obtained  on  a  sole-source 
basis  a  UNIVAC  1100/81  computer  system  dedicated  to  proc¬ 
essing  the  Animal  and  Plant  Health  Inspection  Service 
Brucellosis  Information  Program. 

— KCCC  ordered  a  third  computer  processor  from  Honeywell  in 
October  1980,  21  months  earlier  than  planned.  This  will 
result  in  increased  lease  payments  over  the  21-month  period 
of  about  $291,000.  KCCC  also  intends  to  acquire  an  IBM 
370/158  computer  system  that  will  replace  the  center's 
obsolete  IBM  7074  and  1401  systems. 

— SLCC  intends  to  replace  its  present  Burroughs  computer 
with  a  Burroughs  B4890,  using  a  sole-source  procurement. 
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— In  July  1980  WCC  installed  an  IBM  4341,  a  medium-sized 
computer  system.  WCC  has  also  requested  a  delegation  of 
procurement  authority  from  GSA  for  a  procurement  of  an  IBM 
3033,  a  large-scale  computer  system. 

— NFC  planned  to  obtain  a  third  Honeywell  CPU  under  an 
existing  contract.  However,  the  Department  determined 
this  could  not  be  done  and  is  reassessing  its  information 
processing  needs  and  exploring  procurement  alternatives. 

WEAK  MANAGEMENT  CONTROL — THE  PRIMARY  CAUSE 
OF  COMPUTER  CAPACITY  PROBLEMS 

In  a  number  of  areas  Data  Services  has  demonstrated  weak 
management  control  over  computer  center  operations  and  in  set¬ 
ting,  maintaining,  and  forecasting  computer  capacity.  This  con¬ 
dition  has  resulted  in  problems  with 

—  inefficient  operation  of  the  computer  centers  and  in 
management  of  existing  computer  capacity  and 

—  inadequate  performance  standards  and  measurement. 

The  absence  of  effective  management  practices  and  decisionmaking 
by  Data  Services  contributes  to  inefficiency,  inaccuracy,  and 
overburdening  of  USDA  computer  centers.  We  believe  that  USDA 
will  not  provide  users  with  consistent,  quality  service  and  com¬ 
petitively  procure  computers  as  a  normal  way  of  doing  business 
until  a  central  management  office  is  given  sufficient  authority 
and  assumes  a  stronger  role  in  managing  the  Department's  central 
ADP  resources. 

Inefficiencies  at  centers 
affect  available  computer  capacity 

Poor  data  processing  practices  contribute  to  inefficient 
operations  and  place  unnecessary  demands  on  available  computer 
capacity  at  the  USDA  centers.  Examples  of  these  practices  are 

— the  absence  of  a  systematic  review  process  by  Data 
Services  and  users  to  improve  the  efficiency  of  large 
applications  that  use  unnecessarily  high  amounts 
of  computer  center  resources, 

— user  inattention  to  proper  file-management  practices, 
and 

— poor  scheduling  of  processing  time  during  nonprime 
hour  s . 

The  existence  of  these  poor  practices,  along  with  the  absence  of 
a  policy  and  program  to  deal  with  them,  is  not  consistent  with 
claims  of  computer  saturation  and  requests  for  more  equipment. 
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These  inef f icienc > es  also  point  t-.o  inadequate  management  control 
over  computer  use  by  both  users  and  the  computer  centers. 

We  are  concerned  that,  tne  computer  centers  are  aware  of 
these  deficiencies  yet  permit  them  to  continue.  Before  Data 
Services  can  adequately  justify  requests  for  more  capacity,  it. 
must  demonstrate  efficient,  use  of  existing  resources. 

Applications  are  not  systematically  reviewed 

for  ways  to  improve  efficiency 

Data  Services  has  not  developed  a  systematic  review  process 
to  ensure  that  large  software  applications  do  not  use  unnecessary 
amounts  of  computer  center  resources.  The  OIG  noted  in  a  1978 
report  that.  Data  Services  does  not  require  agencies  to  use  avail¬ 
able  tools  and  services  to  increase  the  efficiency  of  ADP  applica¬ 
tions.  Although  Data  Services  recognized  the  significance  of 
ADP  application  efficiency  in  1979  when  it  established  a  task  force 
to  study  the  problem,  no  action  was  taken  on  the  task  force's  re¬ 
port.  This  lack  of  emphasis  on  and  control  over  software 
application  efficiency  results  in  a  strain  on  computer  capacity. 

In  our  report,  "Wider  CJse  of  Better  Computer  Software 
Technology  Can  Improve  Management  Control  and  Reduce  Costs" 

( FGMSD-80-38 ,  Apr.  29,  1980),  we  found  that  the  proper  applica¬ 
tion  of  software  tools  and  techniques  to  make  applications  pro¬ 
grams  run  faster  and  require  less  computer  storage  can  reduce 
the  computer  resources  needed  to  run  users'  applications  and 
thus  postpone  the  need  to  get  more  expensive,  bigger  computers. 

In  that  report  we  identified  five  computer  installations  where 
significant  savings  were  attributable  to  applications  program 
performance  improvement,  which  reduced  the  machine  resources 
required  to  run  applications  software,  freeing  the  resources 
for  other  work.  For  example,  at  one  installation  $2.4  million 
in  personnel  and  computer  resources  were  freed  by  using  software 
improvement  tools  and  techniques,  thus  helping  the  installation 
delay  an  equipment  acquisition. 

Recognizing  that  it  must  seek  ways  to  handle  its  capacity 
problems  other  than  through  the  purchase  of  additional  equipment, 
Data  Services  formed  a  task  force  to  study  the  efficiency  of  appli¬ 
cations  software.  The  task  force  report,  dated  July  11,  1979,  con¬ 
cluded  that  one  way  to  solve  the  capacity  problem  is  to  increase 
the  effectiveness  of  its  existing  hardware  by  identifying  applica¬ 
tions  that  used  high  resources  and  determining  the  extent  to  which 
they  could  be  made  more  efficient.  The  report  also  included  recom¬ 
mendations  for  a  software  application  review  process;  however,  no 
action  was  taken  on  these  recommendations. 

The  Forest  Service's  forest  planning  model  (FORPLAN)  is  an 
example  of  an  application  that  could  benefit  from  a  thorough  and 
systematic  review  to  improve  its  efficiency  and  lessen  its  demands 
for  computer  resources.  During  our  review,  the  Forest  Service  and 
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Data  Services  initiated  steps  to  improve  the  processing  efficiency 
for  FORPLAN.  FORPLAN  is  a  linear  programing  application  developed 
to  meet  the  Forest  Service's  land  planning  needs.  Under  the  1976 
Land  Management  Act,  the  Congress  directed  the  Forest  Service  to 
prepare  land  management,  plans  for  each  of  its  forests. 

FORPLAN  as  initially  designed  is  a  strain  on  FCCC's  computer 
capacity.  Also,  FCCC  and  Forest  Service  staff  do  not  believe 
that.  FCCC  can  run  FORPLAN  for  all  field  units  because  of  the 
extensive  computer  time  required.  In  addition,  Forest  Service 
officials  were  concerned  that.  FORPLAN  demands  would  severely 
restrict  FCCC's  ability  to  handle  a  large  mapping  program  used  with 
FORPLAN  for  land  management,  planning  and  the  processing  of  other 
Forest.  Service  applications.  Because  of  these  potential  effects, 
the  Forest.  Service  was  seeking  alternative  computer  facilities. 

ASCS  has  done  little  to  improve  application  efficiency.  It 
does  not.  require  its  ADP  units  to  review  application  systems  for 
efficiency.  The  agency's  Management.  Field  Office  evaluates  the 
adequacy  of  internal  controls  for  newly  developed  or  modified 
systems.  However,  the  Field  Office  does  not.  review  the  design  of 
new  or  modified  systems  to  determine  if  they  are  efficient.  Field 
Office  ADP  officials  told  us  they  lack  the  time  and  people  needed 
to  make  such  efficiency  reviews. 

Poor  file-management  practices 

waste  critical  storage  resources 

USDA  has  procedures  for  efficiently  filing  and  storing  com¬ 
puter  data,  but  users  often  overlook  or  avoid  these  procedures. 
Users  are  retaining  seldom-used  disk  or  tape  storage  on  line 
for  long  periods  of  time.  These  conditions  waste  available 
computer  storage  and  result,  in  unnecessary  acquisition  of  storage 
devices. 

Although  the  computer  centers  develop  criteria  for  using  com¬ 
puter  data,  users  often  disregard  these  rules.  The  computer 
centers  write,  maintain,  and  distribute  a  users'  handbook  on 
managing  computer  file  data.  Particulars  include  on-line  storage 
costs,  overall  system  costs  and  benefits,  methods  of  saving  files, 
other  basic  measures  for  efficient  file  storage,  and  "archiving" 
of  files.  (Archiving  involves  transferring  files  from  a  computer's 
costly  disk  storage  to  less-expensive  storage  such  as  magnetic 
tape.)  Computer  files  unused  for  a  prescribed  period  of  time  are 
transferred  to  less-expensive  storage  media.  Despite  these  cost, 
saving  procedures  for  handling  computer  files,  some  users  override 
the  system  by  needlessly  accessing  their  unused  disk  files  to  show 
usage.  In  addition,  users  have  requested  that,  their  files  be  ex¬ 
cluded  from  archiving.  When  this  occurs,  files  remain  on  the  ex¬ 
pensive  storage  devices  indefinitely  without  being  accessed. 

These  poor  file-management  practices  exist  at  the  Kansas  City 
Computer  Center  where  on-line  data  files  are  unused  for  long 
periods. 
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The  Fort  Collins  Computer  Center  is  experiencing  similar 
problems.  In  its  January  13,  1981,  report  on  FCCC,  the  OIG  con¬ 
cluded  that  the  center's  user  agencies  were  not  adequately 
reviewing  computer  files  stored  at  FCCC  to  determine  which  files 
should  be  purged.  (Purging  is  the  destruction  of  files  that 
the  user  no  longer  needs. )  The  OIG  review  found  that  inactive 
files  were  retained  because  (1)  people  responsible  for  the 
review  did  not  have  the  authority  to  purge  these  files  without 
additional  approval  and  (2)  FCCC  did  not  have  an  internal  control 
system  to  ensure  that  users  were  performing  meaningful  reviews. 

The  OIG  stressed  that  user  file-management  reviews  are  necessary 
to  heJp  the  center  conserve  available  system  resources.  The  OIG 
report  also  indicated  that  95  to  98  percent  of  all  archived  files 
are  due  to  inactivity  rather  than  user  request.  In  other  words, 
users  are  not  generally  taking  the  initiative  to  remove  files  they 
no  longer  need. 

Poor  scheduling  of  computer 

time  results  in  inefficient 

use  of  computer  capacity 

Inefficient  scheduling  of  computer  processing  time  has  pre¬ 
maturely  triggered  requirements  for  additional  computer  equipment 
even  though  existing  capacity  was  available.  For  example,  because 
KCCC  officials  were  unsuccessful  in  persuading  users  to  improve 
computer  time  scheduling,  equipment  was  required  21  months  sooner 
than  anticipated  at  a  cost  of  $291,000. 

KCCC  is  acquiring  more  computer  equipment  even  though  much 
of  its  non-prime- time  computer  capacity  remains  idle.  KCCC's 
Honeywell  computer  system,  installed  in  May  1978,  was  sized  to 
process  40  percent  of  the  workload  during  prime-time  processing 
hours  and  60  percent  during  the  16  nonprime  processing  hours. 
However,  in  1980  the  Honeywell  system's  users,  primarily  ASCS, 
were  claiming  a  need  for  more  prime-time  processing  capability 
even  though  these  users  were  processing  only  43  percent  of  their 
workload  during  the  16  nonprime  hours.  As  a  result,  KCCC  ordered 
a  third  Honeywell  CPU  to  meet  these  demands  for  prime  shift  use. 

The  ASCS  Management  Field  Office,  the  largest  user  of  the  Honeywell 
system,  accounting  for  about  half  of  its  current  use,  did  not 
initiate  action  to  relieve  the  capacity  problem  by  scheduling  work 
to  non-prime-time  hours. 

Inadequate  performance  measurement 
and  capacity  management 

An  effective  computer  capacity  and  performance  measurement 
program  involving  central  management,  the  computer  centers,  and 
users  has  not  been  established.  Data  Services  has  not  provided 
the  necessary  guidance  for  implementing  a  capacity  and  perform¬ 
ance  measurement  program.  The  computer  centers  are  not  assessing 
capacities  or  measuring  computer  performance.  Finally,  poor  user 
success  in  completing  software  projects  on  time  is  contributing 
to  capacity  problems. 
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Data  Services  provides  little  guidance 

Data  Services  has  not  provided  guidance  to  the  computer 
centers  on  setting  standards  for  user  service  levels  or  measuring 
performance  against  standards.  As  a  result,  the  centers  have  not 
developed  adequate  standards  and  have  little  basis  for  measuring 
user  service.  Frequently,  the  centers  learn  about  poor  performance 
when  users  complain.  Some  of  the  important  areas  requiring  per¬ 
formance  standards  for  acceptable  user  service  are  batch  turnaround 
time,  interactive  response  time,  consistency  of  response  times, 
and  reliability. 

An  adequate  performance  program  also  includes  techniques  for 
measuring  and  evaluating  the  actual  service  levels  attained  and 
uniform  reports  tracking  the  actual  levels  against  the  standards. 

An  active  program  can  identify  potential  bottlenecks  or  problem 
areas  and  can  lead  to  corrective  action. 

Centers  do  not  adequately  measure 

performance  or  manage  capacity 

The  USDA  computer  centers  are  not  accurately  assessing 
computer  capacities  or  measuring  performance.  The  computer  cen¬ 
ters  have  not  (1)  developed  adequate  baseline  data,  (2)  accurately 
computed  the  practical  capacity  of  their  equipment,  and  (3)  col¬ 
lected  complete  data  on  the  performance  of  their  input/output 
susbsytems.  The  monthly  reports  to  Data  Services  are  inadequate 
for  management  to  evaluate  performance.  Finally,  Data  Services 
does  not  require  agencies  to  submit  data  on  planned  applications 
so  that  the  computer  centers  can  determine  the  impacts  on  existing 
resources. 

The  computer  centers  have  not  developed  adequate  baseline 
data  in  the  operations  of  their  resources.  Consequently,  they 
have  inadequate  means  of  assessing  the  efficiency  and  effectiveness 
of  their  performance  in  meeting  user  needs. 

In  determining  practical  capacities,  the  centers  are  not 
considering  some  important  factors  which  influence  capacity,  and 
thus  their  estimates  of  practical  capacity  are  incorrect.  For 
example,  an  important  factor  affecting  the  amount  of  practical 
capacity  is  the  kinds  of  work  processed  by  the  computer  systems. 
Varying  kinds  of  work  can  affect  the  entire  formula  by  which  the 
centers  compute  their  practical  capacities.  For  example,  time¬ 
sharing  services,  which  all  centers  offer  primarily  during  prime 
processing  hours,  require  more  operating  system  overhead  (unavail¬ 
able  computer  memory  for  user  applications)  than  batch  work.  For 
instance,  WCC's  overhead  during  prime  time,  when  timesharing 
usually  occurs,  runs  about  48  percent.  During  nonprime  hours  this 
center’s  overhead  is  probably  40  percent  or  less.  But  WCC  uses  48 
percent  as  the  overhead  figure  in  computing  its  practical  capacity. 
As  a  result,  the  center's  actual  average  overhead  is  distorted. 
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The  centers'  data  on  i  nput/output  subsystems  is  incomplete 
and  not.  useful  for  determining  computer  capacity.  Although  the 
centers  collect  some  data  on  their  input/output,  subsystems,  it  is 
not  collected  and  analyzed  on  a  recurring  basis.  Further,  the  cen¬ 
ters  do  not  have  any  performance  criteria  to  use  as  a  basis  for 
measuring  performance.  Thus,  the  data  is  of  little  value. 

The  monthly  reports  submitted  to  Data  Services  by  the  computer 
centers  are  inadequate  for  monitoring  performance  and  capacity. 

These  reports  are  the  only  routine  communications  between  Data  Serv¬ 
ices  and  the  computer  centers  which  address  capacity  and  perform¬ 
ance.  These  monthly  reports,  which  show  such  information  as  number 
of  jobs  run  and  actual  CPU  hours  used,  are  of  little  value  to  top 
management  in  determining  the  center's  efficiency  and  effectiveness. 
The  reports  do  not  offer  performance  standards  for  comparison  and 
evaluation  to  actual  performance,  and  many  areas  of  performance 
are  not  recorded.  In  addition,  FCCC  and  WCC  reports  of  CPU  hours 
used  are  misleading  and  do  not  reflect  true  workload  increases  that 
occur  when  equipment  is  upgraded.  Without  adequate  reporting.  Data 
Services  and  the  centers  have  no  assurance  that  computer  capacities 
are  adequate  and  meet  the  users'  information  needs. 

Data  Services  does  not  require  agencies  to  notify  the  computer 
centers  of  new  applications  so  that  the  impact  of  these  new  systems 
on  existing  resources  can  be  determined.  Center  officials  indicated 
in  written  responses  to  our  background  questionnaire  that  users  do 
not  routinely  keep  center  officials  current  on  the  status  of  new 
and  existing  computer  applications.  One  contributing  problem  is 
that  Data  Services  manages  and  operates  its  computer  centers  as 
"utilities"  to  meet  the  needs  of  users  but  restricts  its  involvement, 
in  the  process  of  determining  user  information  needs  and  services. 

It  believes  its  mission  is  to  ensure  that  adequate  ADP  resources 
are  available.  In  particular,  the  centers  have  not  obtained  work¬ 
load  data  from  user  organizations  and  have  not  conducted  analyses 
on  a  continuing  basis. 

Delayed  software  projects 

worsen  capacity  problem 

As  discussed  in  chapter  3,  computer  software  conversions  at 
the  National  Finance  Center  and  Kansas  City  Computer  Center  have 
been  costly  and  are  incurring  significant  time  overruns.  There¬ 
fore,  use  of  old  computers  continues  while  new  equipment  is  not. 
used  to  the  fullest  possible  extent  or  is  not  used  as  intended 
when  acquired.  For  instance,  in  1978,  both  computer  sites  had 
Honeywell  66/80  computer  systems  installed,  but  conversion  of 
computer  applications  from  the  old  to  the  new  computer  systems 
remains  incomplete.  Also,  USDA  is  still  using  many  obsolete  com¬ 
puter  systems  because  users  have  had  difficulty  in  completing 
large  software  projects  on  time. 
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In  early  1977  USDA  prepared  a  release  schedule  for  13 
obsolete  or  obsolescent  computers  at  Kansas  City,  New  Orleans,  and 
St.  Louis.  However,  11  of  these  systems  have  not  been  released. 

The  obsolete  computers  are  inefficient,  and  vendor  maintenance  is 
no  longer  guaranteed.  The  1977  schedule  called  for  releasing 
five  of  NFC's  computer  systems  by  December  1979.  Four  of  the  NFC 
computers  date  from  the  early  1960s  and  one  from  the  late  1960s. 
However,  today  all  of  these  systems  are  still  operating,  and  NFC 
has  acquired  another  IBM  7080  which  also  dates  back  to  the  early 
1960s.  KCCC  still  has  two  older  IBM  7074s  and  two  1401s.  St. 

Louis  has  obsolescent  Burroughs  3500  and  4781  computers  which  were 
scheduled  for  release.  Also,  this  center  was  to  close  when  the  UMIS 
system  became  operational  on  the  KCCC  Honeywell  system.  Since  the 
UMIS  system  is  not  operational,  the  obsolescent  Burroughs  computers 
are  still  running  at  St.  Louis,  processing  FmHA's  current  account¬ 
ing  and  information  system. 

In  a  recent  report,  "Continued  Use  of  Costly,  Outmoded  Com¬ 
puters  in  Federal  Agencies  Can  Be  Avoided"  (AFMD-81-9,  Dec.  15, 
1980),  we  concluded  that  the  use  of  obsolescent  computers  involves 
unnecessary  costs  and  problems.  Our  work  showed  that  the  opera¬ 
tional  costs  of  obsolescent  Government-owned  equipment  can  exceed 
the  costs  of  using  newer  equipment  even  if  the  newer  equipment  is 
obtained  on  a  short-term  basis.  Other,  frequently  unrecognized 
costs  of  using  older  equipment  include  less  efficient  processing, 
increased  personnel  costs,  greater  floor  space  requirements,  and 
the  need  to  rely  on  backup  facilities  when  older,  unreliable 
equipment,  breaks  down.  In  addition  to  higher  costs,  agencies 
using  obsolescent  equipment  face  many  operational  problems,  in¬ 
cluding  inflexibilities  imposed  by  limitations  of  the  older  equip¬ 
ment  and  frequent  unavailability  of  the  system  due  to  mainrenance 
requirements  and  equipment  failures. 

USDA  also  continues  to  experience  problems  with  workload 
forecasts  and  the  corresponding  need  for  computer  capacity.  in¬ 
adequate  forecasting  has  contributed  to  the  saturation  of  computer 
capacity.  Although  workload  forecasting  is  performed  to  justify 
procurement  requests  for  additional  equipment,  it  is  not  a 
continuing,  formal  process.  In  addition,  USDA  agencies,  as 
discussed  in  chapter  6,  do  little  long-range  ADP  planning  outside 
the  annual  budget  process.  The  lack  of  planning  has  contributed 
to  the  computer  centers'  inability  to  properly  manage  capacity. 

Data  Services  had  established  a  procedure  for  keeping  abreast 
of  new  USDA  ADP  applications,  but  according  to  written  USDA  respon¬ 
ses  to  our  questions,  it  fell  into  disuse  due  to  the  lack  of  a  ve¬ 
hicle  for  enforcing  its  use.  The  procedure  is  not.  being  followed. 
The  procedure  applies  to  all  applications  in  which  development,  and 
operating  costs  may  exceed  $25,000  in  any  fiscal  year.  Information 
on  Form  ADS-1,  Request,  for  Agency  Planning  Data,  the  form  needed  to 
comply  with  the  procedure,  would  provide  the  centers  with  computer 
processing  requirements  of  the  proposed  application. 
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Users  also  need  to  establish  performance  service  levels  and 
adopt  practices  to  properly  forecast  workloads  and  manage  software 
projects . 

LIMITED  CENTRAL  CONTROL  OVER 
ADP  OPERATIONS  AT  THE 
NATIONAL  FINANCE  CENTER 

Data  Services  has  exercised  little  oversight  over  the  ADP 
operations  at  NFC.  Until  the  1977  USDA  reorganization,  NFC  ob¬ 
tained  its  major  computer  processing  support  from  the  collocated 
New  Orleans  Computer  Center.  NFC's  limited  computer  equipment 
consisted  of  minicomputers,  used  primarily  for  data  entry  and  in¬ 
quiry  purposes.  USDA  then  merged  the  New  Orleans  center  into  NFC 
to  provide  "streamlined  management"  over  these  resources,  which 
were  considered  critical  to  NFC's  mission.  According  to  the  Direc¬ 
tor  of  NFC,  the  merger  was  fully  justified  because  NFC  had  become 
the  center's  only  user,  and  the  duplication  of  certain  functions 
made  no  sense.  However,  no  economic  analysis  of  the  merger  was 
ever  performed.  In  addition,  USDA  has  not  conducted  a  postimple¬ 
mentation  review  to  ensure  that  the  merger  was  working  and  that 
the  center  was  efficiently  operated. 

The  House  Committee  on  Government  Operations  has  expressed 
concern  over  this  move.  In  a  1978  letter  to  the  Secretary  of 
Agriculture,  the  chairman  indicated  that  the  merger  was  not  con¬ 
sistent  with  the  stated  purpose  of  large  ADP  computer  centers 
that  serve  many  users.  The  departmental  computer  centers  were 
established  to  halt  a  proliferation  of  computers  throughout  the 
agencies.  Department-run  centers  were  to  reap  the  benefits  of 
sharing  resources.  We  believe,  given  the  economic  benefits  of 
large  computer  centers  serving  many  users,  that  before  an  agency 
acquires  control  over  a  large-scale  computer  facility  (1)  the 
agency  should  economically  justify  such  a  decision  and  (2)  com¬ 
puter  '-enter  operations  should  be  periodically  reviewed  to  en¬ 
sure  efficient  and  effective  use  of  center  resources. 

We  believe  that  this  merger  must  be  assessed  and  justified. 
USDA  should  conduct  a  postimplementation  review  to  determine  if 
the  merger  should  continue  or  whether  the  computer  center  should 
be  returned  to  the  control  of  a  central  office.  Under  the  Paper¬ 
work  Reduction  Act,  the  Department's  information  functions  should 
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come  under  the  jurisdiction  of  the  senior  official  for  the  Depart¬ 
ment.  Therefore,  the  senior  official  should  perform  periodic 
reviews  of  the  computer  center  to  ensure  that  the  center  is  operat¬ 
ing  efficiently  and  effectively. 

CONCLUSIONS 


Computer  centers  do  not  adequately  provide  consistent,  quality 
service  to  users.  Further,  management  does  not  have  sufficient 
information  to  assess  the  performance  of  USDA's  computer  resources. 
In  addition,  computer  capacity  problems  hamper  the  efficiency  of 
computer  centers,  and  procurement  of  more  equipment  is  used  to 
remedy  capacity  problems.  Also,  computer  center  management 
needs  stronger  controls  and  standards  established  to  ensure 
the  most  efficient  operation  of  the  centers. 

The  senior  official  must  conduct  a  rigorous  examination 
of  USDA  computer  center  resources.  In  addressing  its  capacity 
problem  at  computer  centers,  USDA  should  first  consider  alter¬ 
natives  to  acquiring  additional  hardware.  The  demands  of  user 
applications  and  the  availability  of  hardware  resources  must  be 
aligned  so  that  resources  will  be  available  as  demand  increases. 

Users  frequently  estimate  their  workload  requirements  with 
little  accuracy.  A  formal  forecasting  and  analysis  process  is 
needed  along  with  more  guidance  from  Data  Services  if  workload 
forecasting  is  to  be  improved. 

New  and  existing  applications  which  have  a  considerable 
impact  on  hardware  resources  should  be  identified  and  analyzed. 
Applications  which  are  determined  to  be  inefficient  should  be 
submitted  for  a  management  review  for  action. 

USDA  needs  a  comprehensive  computer  performance  management 
program  to  measure  and  evaluate  the  efficiency  and  effectiveness 
of  ADP  resources,  including  requests  for  ADP  equipment,  and  assure 
greater  control  over  the  use  of  ADP  resources. 

Under  the  current  USDA  organizational  structure,  responsibil¬ 
ity  for  managing,  controlling,  and  using  computer  resources  is 
divided  between  the  users  and  centers.  We  believe  that  the  senior 
official  should  involve  his  office  with  users  to  assure  that  com¬ 
puter  centers  are  used  more  effectively  and  efficiently. 

RECOMMENDATIONS  TO  THE 
SECRETARY  OF  AGRICULTURE 

We  recommend  that  the  Secretary  of  Agriculture  direct  the 
senior  official  appointed  under  the  Paperwork  Reduction  Act  to: 

— Establish  a  computer  performance  management  program, 
including  objectives  for  user  service  levels;  uniform 
reporting  on  performance,  capacity,  and  utilization; 
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and  standard  operating  procedures  related  to  efficient 
use  of  computer  center  resources. 

— Develop,  implement,  and  enforce  procedures  for  workload 
forecasts . 

— Require  user  organizations  to  provide  computer  centers 
with  timely  and  complete  workload  forecasts  for  use  in 
the  CPM  program. 

— Conduct  a  postimplementation  review  to  determine  whether 
the  National  Finance  Center  should  continue  managing 
its  computer  center.  If  the  review  shows  NFC  should 
not,  responsibility  for  managing  the  computer  center 
should  be  returned  to  a  central  office. 
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CHAPTER  5 

USDA  NEEDS  TO  GIVE  A 
HIGHER  PRIORITY  TO  ADP  SECURITY 

In  the  face  of  mounting  evidence  of  widespread  inadequate 
ADP  security,  USDA  has  given  little  emphasis  to  this  subtle  but 
vital  aspect  of  ADP  management.  Effective  security  is  especially 
important  to  USDA  because  it  relies  heavily  on  ADP  resources  to 
manage  its  multibillion-dollar  loan/grant  programs  and  adminis¬ 
trative  functions.  Moreover,  USDA's  automated  files  contain 
sensitive  program  information  and  extensive  data  restricted  from 
general  access  by  the  Privacy  Act  of  1974  (Public  Law  93-579). 
Nonetheless,  our  past  and  present  reviews,  as  well  as  several 
reports  issued  by  USDA's  Office  of  Inspector  General,  have 
documented  security  shortcomings.  USDA  has  not  been  effective 
in  assuring  that  identified  deficiencies  have  been  corrected. 

Data  Services,  the  office  charged  with  the  responsibility  of 
managing  USDA's  ADP  security  function,  has  been  unable  to  assure 
that  agencies  are  following  applicable  guidelines  and  sound 
practices.  As  with  other  areas  of  ADP  management,  its  role  has 
been  limited  to  providing  guidelines,  standards,  and  rendering 
advice  rather  than  enforcing  compliance.  A  strong  IRM  office, 
as  discussed  in  chapter  2,  with  the  authority  and  the  mandate 
to  emphasize  security  can  provide  the  leadership  necessary 
to  make  effective  USDA  ADP  security  a  reality. 

ADP  SECURITY  IS  PARAMOUNT 

Our  earlier  reports  dealing  with  various  Federal  agencies 
have  described  serious  and/or  expensive  computer- related 
losses  such  as 

— more  than  $90,000  in  fictitious  welfare  claims  entered  by  a 
single  clerk, 

— nearly  $100,000  in  payments  to  fictitious  companies  based 
on  fraudulent  documents  entered  by  a  single  employee,  and 

— the  theft  of  a  large  volume  of  classified  energy  information 
by  a  single  "burglar"  via  a  telephone  terminal. 

Importance  to  USDA 

Because  USDA  is  a  large,  diverse  organization  with  huge  finan¬ 
cial  programs  dependent  on  computer  support,  adequate  ADP  security 
needs  strong  emphasis.  The  USDA  computer  centers  support  agency 
management  of  multibillion-dollar  loan  and  grant  programs.  For 
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example,  the  Agricultural  Stabilization  and  Conservation  Service 
made  $3.9  billion  in  commodity  loans  during  1980  via  the  Kansas 
City  Computer  Center.  The  National  Finance  Center  in  New  Orleans 
processes  the  USDA  payroll,  pays  USDA's  bills,  and  makes  certain 
collections  which  totaled  more  than  $4  billion  in  1980. 

These  dollar  volumes  make  USDA's  computer  facilities  an 
attractive  target  for  fraud  and  offer  a  potential  for  expensive 
human  errors.  Furthermore,  each  facility  has  significant  per¬ 
sonnel  data  in  its  automated  files  which  should  be  given  the 
special  protection  required  by  the  Privacy  Act.  1/  Partially 
because  of  inadequate  security  planning  to  protect  sensitive 
and  personal  data,  USDA  was  forced  to  abandon  a  proposed 
$398  million  A DP  procurement  in  1975.  (See  app.  I.) 

An  ounce  of  prevention 

This  potential  for  loss  may  be  significantly  reduced  through 
an  effective  security  program  designed  to  ensure  that  (1)  unau¬ 
thorized  uses  of  data  processing  resources  are  reasonably  pre¬ 
vented  and  (2)  authorized  uses  are  carried  out  reliably, 
accurately,  and  with  as  little  interruption  as  possible. 

The  elements  of  an  effective  security  program  may  be 
classified  into  three  categories. 

— Physical  security  controls  prevent  unauthorized  access  to 
areas  harboring  the  ADP  equipment  by  such  means  as  locks, 
guards,  and  badge  identification  requirements. 

— Technical  controls  are  built  into  the  computer  system  to 
limit  terminal  use  and  protect  programs  from  unauthorized 
changes.  For  example,  passwords  may  be  used  to  restrict 
access  to  a  computer  system  or  protect  computer  files. 

— Administrative  controls  are  procedures  instituted  by 

management  to  ensure  the  effectiveness  of  other  controls. 
These  measures  include  controlling  the  issuance  and  use 
of  magnetic  key  cards  for  computer  room  entry  and  ensuring 
the  development  of  adequate  security/contingency  plans. 


1/The  Congress  included  in  the  Privacy  Act  of  1974  a  requirement 
for  each  agency  to  (1)  establish  appropriate  technical,  ad¬ 
ministrative,  and  physical  safeguards  to  assure  the  security 
and  confidentiality  of  records  and  (2)  protect  against  any 
anticipated  threats  or  hazards  to  their  security  or  integrity 
which  could  result  in  substantial  harm,  embarrassment,  incon¬ 
venience,  or  unfairness  to  any  individual  on  whom  information 
is  maintained. 
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Security  measures  require  front-end  planning  and  consistent 
implementation;  relegating  them  to  a  low  priority  creates  an 
unacceptable  risk.  Office  of  Management  and  Budget  Circular 
A-71,  Transmittal  Memorandum  No.  1,  dated  July  27,  1978,  "Security 
of  Federal  automated  information  systems,"  which  provides  instruc¬ 
tions  on  security  matters,  requires  agencies  to 

— perform  risk  analyses  prior  to  the  approval  of  design 
specifications  for  new  computer  installations  and  at 
other  specified  times; 

— plan  for  contingencies — that  is,  interruptions  in  computer 
operations;  and 

—  incorporate  appropriate  security  features  into  software 
before  it  becomes  operational. 

CONTINUING  DEFICIENCIES  REFLECT 
A  LACK  OF  DEPARTMENTAL  OVERSIGHT 


Although  departmental  ADP  security  guidance  has  been  distrib¬ 
uted  to  agencies,  we  and  USDA's  OIG  continue  to  identify  defi¬ 
ciencies  throughout  USDA.  Several  of  these  problems  have  been 
previously  reported  to  the  Congress  and  the  Secretary  of  Agricul¬ 
ture.  These  inadequacies  reflected  a  lack  of  departmental  over¬ 
sight. 

OIG  reports  show 
continuing  deficiencies 

Major  OIG  audit  reports  issued  in  1978,  1980,  and  1981 
illustrate  continuing  deficiencies  in  computer  center  security 
practices.  We  believe  central  office  oversight  could  have 
prevented  or  corrected  these  problems  sooner. 

Washington  Computer  Center 

Based  on  its  review  of  ADP  security  at  WCC,  the  OIG  reported 
in  October  1978,  that  over  a  1-year  period  some  6,400  unauthorized 
computer  file  accesses  had  been  made.  The  report  stated  that 
although  no  evidence  of  large  dollar  losses  was  found,  a  very 
real  potential  existed  for  large  dollar  losses,  damage  to  agencies’ 
operations,  lawsuits,  and  embarrassment  to  the  Department.  It 
cited  four  causes  for  ADP  security  weaknesses:  (1)  a  general 
lack  of  management  concern  and  emphasis  on  computer  security, 

(2)  poor  computer  security  procedures  at  WCC  and  among  user 
agencies,  (3)  WCC  and  user  agency  noncompliance  with  existing 
Department  security  standards  and  guidelines,  and  (4)  no  central 
management  organization  with  the  day-to-day  responsibility  and 
authority  for  monitoring  and  enforcing  computer  security  procedures 
and  standards  among  the  agencies. 
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About  2  years  later  the  OIG  issued  another  report,  on 
security  at  WCC.  The  report  found  that,  responsive  actions  were 
initiated  by  the  Office  of  Operations  and  Finance  in  regard 
to  the  recommendations  contained  in  the  prior  audit.  However, 
there  were  areas  in  which  the  corrective  action  intended  by  O&F 
had  not  been  implemented  at  the  user  agency  level.  OIG  attributed 
this  problem  to  a  lack  of  followup  by  O&F  to  determine  that  new 
procedures  were  understood  and  fully  implemented. 

NFC,  both  a  user  and  provider  of  ADP  services,  also  reviewed 
the  first.  WCC  report.  It  identified  several  of  the  same  weaknesses, 
such  as  unprotected  sensitive  files,  but  it.  did  little  to  improve 
the  situation,  as  discussed  below. 

Fort  Collins  Computer  Center 

In  January  1981  the  OIG  issued  a  report  on  ADP  security 
at  FCCC.  Again,  the  OIG  found  that  user  agencies  were  not.  complying 
with  existing  ADP  security  standards  because  agency  management,  had 
not  placed  a  high  priority  on  ADP  security.  Specifically,  users 
had  not 

— adequately  protected  valuable  and  sensitive  files  from 
unauthorized  access, 

— developed  sufficient.  ADP  security  guidance  to  supplement, 
departmental  guidance,  and/or 

— ensured  that  security  programs  were  implemented  at  operating 
levels. 

Moreover,  the  inadequate  user  file-protection  practices  were 
worsened  by  the  fact  that  FCCC  did  not  properly  safeguard  user 
access  codes.  Physical  security  was  also  lax.  Facility  door  keys 
and  computer  room  access  key  cards  were  inadequately  controlled. 

Limited  improvements  in 
NFC  security  deficiencies 

In  December  1977  we  issued  a  report  1/  describing  security 
problems  at  both  NFC  and  the  New  Orleans  Computer  Center,  which 
later  was  merged  into  NFC.  Many  of  these  problems  have  not  been 
corrected.  We  recommended  that  USDA  reevaluate  the  security  pro¬ 
grams  of  NFC  and  the  New  Orleans  Computer  Center  to  assure  that 
all  needed  safeguards  were  implemented  before  the  major  new 
computer  system  became  operational.  Although  USDA  agreed  that  a 


^/"Cooperative  Actions  Result  in  More  Economical  Computer  Acquisi¬ 
tion  and  Improved  Security  at.  the  New  Orleans  Computer  Center" 
(LCD-77-118,  Dec.  23,  1977). 


reevaluation  was  necessary  and  stated  that  a  commercial  contract 
had  been  awarded  for  that  purpose,  we  found  no  evidence  showing 
that  any  such  contract  had  been  awarded.  The  acting  NFC  Direc¬ 
tor  and  the  NFC  security  officer  told  us  that  they  were  unaware 
of  any  such  contract  having  been  awarded. 

Persistent  problems 

in  physical  security 

NFC's  ADP  security  measures  depend  heavily  on  installation 
security.  However,  we  found  several  deficiencies  which  suggest 
this  should  not  be  the  case.  NFC  is  located  on  a  fenced  instal¬ 
lation  operated  by  the  National  Aeronautics  and  Space  Adminis¬ 
tration,  which  contracted  for  the  guard  service.  According  to 
NFC's  security  plan,  photographic  badges  are  required  to  gain 
entrance  to  the  installation,  and  all  personnel  are  required  to 
prominently  display  their  badges. 

As  in  our  earlier  review,  we  found  that  temporary  badges 
were  not  controlled  and  that  the  guard  service  did  not  consist¬ 
ently  examine  badges.  In  random  tests,  we  gained  entrance  to  the 
facilities  both  on  foot  and  by  automobile  displaying  expired, 
improper,  or  no  badges.  We  also  found  that  even  though  many  NFC 
employees  did  not  display  their  badges  while  in  the  building, 
they  were  rarely  if  ever  challenged.  These  weaknesses  compound 
the  risks  created  by  the  lack  of  system  access  controls  discussed 
below. 

At  the  conclusion  of  our  review,  physical  barriers  were 
improved  and  the  guard  service  took  certain  actions  which  reduced 
the  potential  for  unauthorized  entry.  Nonetheless,  installation 
security  may  still  be  breached  and  should  not  be  a  critical  ele¬ 
ment  of  NFC's  security.  NFC  should  give  greater  emphasis  to  the 
security  measures  it  has  direct  control  over,  such  as  system 
access  controls  and  program  certification. 

System  access  controls 

are  still  inadequate 


NFC  has  taken  some  actions  to  improve  its  defenses  against 
unauthorized  access  of  its  ADP  systems.  Nevertheless,  the  poten¬ 
tial  for  unauthorized  access  remains  significant. 

In  our  1977  report,  we  noted  that  data  terminal  controls  were 
inadequate,  especially  in  the  area  of  sensitive  file  protection. 
Data  entry  devices  were  located  in  unsecured,  open  areas,  and  some 
data  files  were  not  properly  protected.  In  our  current  review, 
we  again  found  this  condition,  worsened  by  lax  controls  over 
passwords  and  user  identification  numbers  that  control  access 
to  data  entry  devices  and  the  main  computers.  We  also  found  that 
much  of  NFC's  system  software  documentation  is  kept  in  unlocked 
cabinets,  and  the  application  program  runbooks  are  shelved  in 
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two  unlocked  rooms,  freely  accessible  to  anyone  after  normal 
working  hours.  Because  such  documentation  can  facilitate 
unauthorized  software  changes,  it  should  be  better  protected. 

NFC  recognized  that  many  of  its  systems  running  on  an 
older  computer  were  not  adequately  protected  from  unauthorized 
access.  However,  several  sensitive  systems  are  likely  to  be 
running  on  the  old  equipment  for  some  time  and  merit  bona  fide 
protection. 

In  our  earlier  review,  we  also  found  that  controls  over 
access  to  NFC's  computer  rooms  were  insufficient  and  not  properly 
enforced.  For  example,  an  extra  magnetic  key  card  was  placed  on 
a  hook  for  convenience  in  entering  the  computer  room.  The  security 
officer  has  tightened  up  controls  over  key  cards  and  strengthened 
other  physical  controls,  but  he  acknowleged  that  entry  would  still 
not  be  difficult.  In  his  presence,  we  gained  access  to  the  computer 
room  without  benefit  of  a  card  or  visible  identification.  The 
security  officer  believes  the  real  barrier  to  unauthorized  entry 
is  the  continual  presence  of  NFC  personnel.  However,  we  believe 
this  barrier  depends  heavily  on  employees'  willingness  to  challenge 
anyone  and  the  burden  of  their  workload.  In  any  event,  it  offers 
little  protection  against  unauthorized  access. 

Continued  lack  of 

program  certification 

Our  prior  report  noted  "practically  nonexistent"  controls 
over  programers.  Among  other  problems,  we  found  that  some  test 
(uncontrolled)  programs,  rather  than  controlled  programs,  were 
being  used  for  production  runs  and  that  programers'  work  was  not 
being  independently  tested  to  "certify"  its  accuracy  and  propriety. 
Such  use  of  test  programs  is  being  more  closely  monitored,  but 
the  certification  function  has  generally  not  been  performed. 

Virtually  none  of  NFC's  sensitive  payments  systems  have 
been  "certified"  or  independently  reviewed  to  assure  that 
the  programs  do  only  what  they  were  authorized  to  do.  While  NFC 
is  subjecting  some  redesigned  payroll/personnel  system  programs 
to  detailed  independent  review,  these  efforts  were  not  intended 
to  ensure  the  programs'  propriety.  The  lack  of  certification 
effectively  renders  the  controlled  programs  no  better  than  the 
test  programs  and  raises  the  potential  for  "Trojan  horses," 
that  is,  imbedded  lines  of  code  written  for  fraudulent  purposes. 

LACK  OF  PLANNING  INCREASES 
USDA's  VULNERABILITY 

USDA's  ADP  regulations  and  standards  recognize  the  impor¬ 
tance  of  security  planning.  However,  Data  Services  has  been 
unable  to  ensure  that  the  ADP  planning  function  was  adequately 
emphasized  by  agencies  and  computer  centers.  As  a  result, 
security  risks  are  not  being  satisfactorily  dealt  with,  and 
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some  US DA  agencies  have  become  highly,  vulnerable  to  extended 
interruptions  in  processing  in  the  event  of  a  disaster. 

Improved  planning  should  be  directed  by  management  before  a 
catastrophe  forces  such  actions. 

Deficient  security  plans 

The  adequacy  of  security  plans  submitted  to  Data  Services 
varied  widely.  Although  departmental  information-processing 
standards  require  agencies  and  computer  centers  to  submit  or 
update  security  plans  annually  for  review  by  Data  Services, 
several  agencies  and  computer  centers  had  not  done  so.  For 
example,  the  Forest  Service  had  no  overall  plan  but  had  sub¬ 
mitted  plans  for  certain  regions  or  computer  facilities.  Two 
computer  centers  had  not  submitted  timely  updates  to  their 
security  plans  and  had  not  included  risk  analyses,  which  are  the 
bases  for  such  planning  efforts.  Another  center  had  submitted 
an  incomplete  plan. 

The  remaining  center  submitted  a  current  security  plan  and 
risk  analysis,  both  rated  excellent  by  Data  Services.  However, 
the  plan  lacked  adequate  provisions  for  emergency  offsite  process 
ing  backup,  and  we  found  it  was  essentially  not  implemented.  For 
instance,  according  to  the  plan, 

"Terminals  are  not  secured  by  locks,  but  the  instal¬ 
lation  is  considered  secure.  Additional  security  is 
provided  by  unpublished  telephone  numbers,  account¬ 
ing  codes,  operator  identification  and  password 
protection  of  sensitive  files." 


We  found,  however,  that  the  installation  was  not  secure,  the 
identification  and  passwords  were  not  safeguarded,  and  most 
sensitive  files  were  not  protected  by  passwords. 

Contingency  planning  inadequate 

Despite  the  well-recognized  need  to  ensure  continued  ADP 
operations  in  the  event  of  a  disaster,  USDA  has  given  little 
emphasis  to  planning  for  such  contingencies.  As  a  result,  this 
important  function  has  given  way  to  more  immediate  priorities 
at  a  growing  risk  to  system  users. 


For  example,  the  Kansas  City  Computer  Center  and  NFC  rely  on 
each  other  as  offsite  backup  for  their  Honeywell  computers.  How¬ 
ever,  they  have  not  performed  the  coordination  and  detailed  plan¬ 
ning  necessary  to  reasonably  assure  the  feasibility  of  this  ap¬ 
proach.  Issues  such  as  the  adequacy  of  peripheral  devices,  com¬ 
patibility  of  system  software,  and  the  relative  importance  of 
applications  to  be  supported  have  yet  to  be  worked  out.  Written 
agreements  have  not  been  executed  to  assure  that  the  centers 
will  make  emergency  processing  time  available  for  each  other. 
Furthermore,  the  critical  software  systems  which  must  continue 
running  during  such  emergencies  have  not  been  identified  by  users 
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At  the  other  USDA  computer  centers,  OIG  found  users 
had  done  little  contingency  planning.  For  example, 

— users  had  not  identified  or  set  priorities  for  their 
critical  systems, 

— offsite  file  protection  procedures  were  inadequate  or 
were  not  being  followed,  and 

— one  center's  user  manual  overstated  its  ability  to  pro¬ 
vide  emergency  backup  support. 

However,  in  responding  to  OIG  audits.  Data  Services  indicated  it 
could  only  encourage  agencies  to  make  contingency  planning 
improvements,  not  require  that  they  do  so. 

DEPARTMENTAL  EMPHASIS  NEEDED 

USDA  cannot  wait  for  a  catastrophe  to  bolster  its  security 
program.  It  should  reaffirm  its  commitment  to  adequate  ADP 
security  and  provide  the  responsible  office  with  the  authority  and 
resources  necessary  to  assure  full  implementation  of  departmental 
guidelines.  Particular  emphasis  should  be  given  to  detailed 
planning  for  emergency  backup  processing  support.  Departmental 
advisory  efforts  have  not  brought  about  a  reasonable  degree  of 
security  emphasis  by  agency  or  computer  center  top  management. 
Therefore,  an  enforcement  mechanism  is  needed  to  monitor  and 
evaluate  ADP  security  practices  throughout  USDA. 

Security  officers  get  little 
support  from  top  management 

Because  of  the  nature  of  their  duties  and  their  organizational 
positions,  ADP  security  officers  must  have  the  full  support  of 
top  management.  In  USDA,  however,  effective  security  has  been 
undermined  by  a  lack  of  such  support.  Describing  concerns  raised 
in  a  meeting  of  agency  and  computer  center  security  officers  in 
September  1980,  O&F  noted  that 

"It  is  not  an  overstatement  to  say  that  the  Security 
Officers'  perception  is  that  indifference  of  top  man¬ 
agement  to  security  concerns  is  their  chief  obstacle  to 
achieving  any  realistic  improvements  in  security 
administration. " 

A  good  security  program  may  silently  prevent  computer  crimes 
without  the  knowledge  of  management.  Similarly,  planning  for  emer¬ 
gency  backup  processing  support  may  not  be  missed  until  the  back¬ 
up  is  needed. 

An  effective  program  requires  that  a  security  officer  be 
involved  in  planning,  computer  operations,  procurement,  soft¬ 
ware  development,  and  records  storage,  among  other  activities. 


Without  strong  support  from  the  top,  a  security  officer's 
duties  are  difficult  to  perform. 

Strong  oversight  mechanism  needed 
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Although  ADP  security  is  a  less  visible  activity,  it  is 
necessary  to  protect  USDA's  ADP  assets.  Therefore,  ADP  security 
needs  the  support  from  agency  top  management  and  a  strong.  De¬ 
partment-level  oversight  mechanism.  Data  Services,  the  office 
charged  with  the  responsibility  for  USDA's  security  program, 
has  not  attempted  to  enforce  departmental  security  regulations. 

Data  Services'  parent  organization,  O&F,  maintains  that 
its  role  is  more  properly  one  of  providing  advice  and  assist¬ 
ance  rather  than  enforcement.  For  example,  in  response  to 
recommendations  contained  in  OIG's  second  report  on  the 
Washington  Computer  Center,  O&F  said 

"A  number  of  the  recommendations  require  O&F  over¬ 
sight  of  agencies'  operational  security  or  reemphasis 
of  specific  agency  security  responsibilities.  Our 
policy  has  been  to  issue  standards  and  guidelines  for 
developing  and  maintaining  adequate  security,  to 
assist  agencies  to  the  maximum  when  requested,  to 
train  security  officers,  and  to  review  security  plans 
and  make  recommendations  for  improvement. 

"We  believe  that  operational  security  responsibility 
properly  lies  with  the  agencies  and  Departmental 
Computer  Centers.  We  will  continue  to  instruct, 
exhort,  assist,  and  encourage  those  with  operational 
responsibility,  recognizing  that  progress,  while 
steady,  may  be  slow." 

O&F  provided  a  similar  response  to  OIG's  report  on  the  Fort 
Collins  Computer  Center. 

Citing  the  seriousness  of  deficiencies  discussed  in  OIG's 
first  Washington  Computer  Center  report,  the  Secretary  of  Agri¬ 
culture  issued  a  memorandum  which  stated,  in  part: 

"This  memorandum  expresses  my  full  support  of 
a  stronger  computer  security  system  within  the 
Department.  I  strongly  urge  all  managers, 
especially  Assistant  Secretaries  and  Admin¬ 
istrators,  to  place  more  emphasis  on  computer 
security  to  insure  that  all  USDA  employees  and 
contractor  personnel  comply  with  existing 
Departmental  security  standards  and  procedures." 

***** 

"All  personnel  are  reminded  that  the  Assistant 
Secretary  for  Administration  has  the  responsibility 
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and  authority  to  establish  the  necessary  mechanisms 

to  monitor  and  enforce  all  security  standards  and 

procedures  involving  ADP  activities  within  the 

Department . " 

Although  this  memorandum  clarifies  the  enforcement 
authority  of  O&F  through  its  immediate  superior,  the  Assistant 
Secretary  for  Administration,  O&F  has  relegated  enforcement  to 
the  agencies  where  it  has  not  worked.  Both  our  findings  and 
those  of  OIG  suggest  that  the  memorandum  was  not  adequately 
heeded  by  agencies  and  the  computer  centers.  A  strong  enforce¬ 
ment  mechanism  is  needed  to  ensure  compliance  with  security 
regulations  and  foster  greater  support  for  agency  security 
officers. 

O&F  officials  believe  that  the  OIG  should  act  as  the  en¬ 
forcement  authority  for  ADP  security.  OIG  officials  told  us 
that  enforcement  of  ADP  security  regulations  should  be  the 
prerogative  and  responsibility  of  a  central  IRM  office.  We 
agree.  The  OIG  is  an  audit  and  investigative  service  which 
rightfully  identifies  deficiencies  and  recommends  courses  of 
action  to  top  managers,  such  as  the  Director  of  O&F. 

CONCLUSIONS 

Continuing  security  deficiencies  among  computer  centers  and 
agencies  reflect  inadequate  Department-level  emphasis  on  this 
vital  area  of  ADP  management.  Users  of  USDA  computer  centers 
are  particularly  vulnerable  to  lengthy  interruptions  in  processing 
because  of  a  general  lack  of  planning  for  emergency  backup  support. 

The  central  ADP  office's  advisory  and  assistance  orientation 
has  done  little  to  overcome  these  problems;  therefore,  a  strong 
oversight  mechanism  is  needed.  We  believe  the  office's  parent 
organization,  O&F,  is  uncertain  of  its  enforcement  authority. 

The  Secretary  of  Agriculture  needs  to  reaffirm  the  Depart¬ 
ment's  commitment  to  a  sound  security  program  and  have  the  senior 
official  establish  the  enforcement  mechanism  necessary  to  bring 
this  about. 

RECOMMENDATIONS  TO  THE 
SECRETARY  OF  AGRICULTURE 

We  recommend  that  the  Secretary  direct  the  senior  official 
designated  under  the  Paperwork  Reduction  Act  to 

— vest  USDA  security  officers  with  sufficient  authority 
to  enforce  security  regulations  over  information  re¬ 
sources  and  ADP  facilities  and 

—  include,  as  part  of  the  periodic  reviews  of  information 
management  activities  required  by  the  Paperwork  Reduction 
Act,  evaluations  of  agencies'  compliance  with  USDA  security 
regulations . 
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CHAPTER  6 


NEED  FOR  A  COMPREHENSIVE  PLANNING  PROCESS 
TO  IMPROVE  MANAGEMENT  OF  INFORMATION  RESOURCES 

USDA  needs  a  comprehensive  planning  process  to  manage 
its  ADP  and  other  information  resources  more  effectively. 

Such  a  planning  process  would  include  long-range  planning, 
short-range  and  project  plans,  and  a  management  review  mech¬ 
anism.  Because  of  deficient  planning  practices,  USDA  fre¬ 
quently  uses  inefficient  and  outdated  ADP  systems  in  managing 
multibillions  of  dollars  in  assets.  These  problems  are  dis¬ 
cussed  more  fully  in  chapters  3,  4,  and  5.  The  impact  of 
using  inefficient  ADP  systems  is  not  easily  measured;  however, 
in  chapter  3  we  identified  millions  of  dollars  in  cost  overruns 
for  software  development  projects  and  delays  in  converting  ADP 
systems  to  modern  equipment. 

Deficient  planning  practices  discussed  in  chapter  4  also 
contributed  to  capacity  problems  when  some  computer  centers 
suddenly  became  too  saturated  to  provide  acceptable  computer 
services.  We  also  noted  in  chapter  5  that  a  lack  of  security 
planning  is  increasing  USDA's  vulnerability  to  extended 
interruptions  in  prc cessing  in  the  event  of  a  disaster. 

A  COMPREHENSIVE  PLANNING  PROCESS  IS 
ESSENTIAL  FOR  EFFECTIVE  INFORMATION 
RESOURCES  MANAGEMENT 

Limited  ADP  resources  intensify  the  need  for  management  to 
concentrate  on  what  is  important  and  avoid  dissipating  resources 
over  too  broad  a  range  of  activities.  Modern  ADP  systems  are 
very  complex  and  frequently  require  years  to  design  and  develop. 
Such  systems  can  be  costly  to  bring  to  a  successful  operating 
mode.  Unless  economically  justifiable,  technically  feasible, 
and  operationally  desirable,  these  high-priced  systems  either 
fail  or  performance  falls  short  of  expectations.  Proper  ADP 
planning  is  needed  to  assure  that  information  systems  meet  expec¬ 
tations  . 

A  comprehensive  ADP  planning  process  is  also  necessary 
to  provide  a  basis  for  making  long-range  ADP  decisions,  setting 
ADP  priorities,  and  managing  ADP  resources  effectively.  The  plan 
is  the  final  product  of  the  planning  process  and  should  reflect 
agency  ADP  strategies,  goals,  and  objectives.  It  could  help  en¬ 
sure  that  the  Department-wide  ADP  program  is  meeting  mission 
requirements  efficiently  and  economically.  For  example,  a 
Department-wide  plan  can  be  used  to  identify  opportunities  for 
eliminating  waste  and  duplication.  In  addition,  the  plan  can 
be  a  valuable  management  tool  for  setting  measurable  milestones 
to  achieve  stated  goals  and  objectives  and  thus  provide  a  useful 
means  to  control  ADP  activities. 
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The  formal  planning  and  budgeting  for  ADP  systems  design  and 
development  activities,  accompanied  by  periodic  and  milestone 
management  reviews,  are  essential  to  managing  and  controlling  ADP 
resources.  All  comprehensive  planning  of  ADP  systems  must  be 
developed  with  broad  representation  from  the  entire  organization. 
Direct  participation  of  employees  across  the  organization  will 
help  in  assuring  continuity  and  success  as  the  agency  moves 
from  the  planning  stage  into  actual  design  and  development,  and 
into  operation. 

Top  management  guidance  on  agencywide  goals,  objectives, 
and  priorities  will  measurably  improve  the  planning  and  decision 
processes.  Clear  assignments  of  responsibility,  authority,  jnd 
accountability  for  resources  to  be  controlled  and  accomplishments 
to  be  achieved  will  also  improve  the  efficiency,  economy,  and 
effectiveness  of  achieving  the  agency's  goals  and  objectives. 

A  formal  planning  process  should  include: 

— Formal,  long-range,  comprehensive  plans,  with  supporting 
budgets,  for  ADP  systems  which  encompass  the  related 
activities  of  systems  design  and  development,  data  proc¬ 
essing,  and  data  communications  and  provide  for 
evolutionary  changes  and  modifications  over  the  proposed 
life  cycle  of  each  ADP  system.  Long-range  planning 
should  focus  on  the  point  in  the  future  where  basic 
directions  could  be  set,  major  resource  requirements 
categories  established,  and  objectives  and  investment 
benefits  realized.  It  should  provide  management 
with  the  life-cycle  economic  impact  for  all  important 
investment  decisions.  To  fulfill  congressional  needs 
for  program  approval  and  to  prepare  proper  agency  budgets, 

5  years  is  appropriate  for  the  long-range  planning  period. 

— Short-range  plans  of  annual  and  lesser  duration  should 

identify  specific  projects,  efforts,  and  functions  involved 
in  ADP  system  design  and  development.  Short-range  plans 
should  provide  information  summarizing  all  projects, 
including  such  overhead  functions  as  management,  adminis¬ 
trative  and  support  personnel,  training,  etc.,  which  are 
essential  to  maintaining  the  productive  capacity  of  a 
system's  design  and  development  activity. 

— Specific  project  plans  should  encompass  the  life  cycle 
of  an  ADP  system  and  identify  the  work  required  to  deliver 
a  system  within  a  specified  time  frame  meeting  defined 
quality  characteristics.  The  projects  should  be  laid  out 
in  a  time-phased  and  orderly  progression  of  stages  with 
supporting  analyses  of  work  functions  and  resource  require¬ 
ments,  including  user  organization  personnel. 
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— Annual  and  moie  frequent  management  reviews,  including 
milestone  reviews,  should  compare  actual  accomplishments 
with  the  agency's  priorities,  goals,  and  objectives  with 
the  assumptions  expressed  in  the  long-range  and  other  plans 

All  long-range,  project,  and  time-period  planning  requires 
financial  expression  as  a  common  denominator  for  management 
decisions  and  reviews.  Appropriate  quantitative  detail  is  also 
needed  for  reviews,  analyses,  and  other  evaluations  and  for 
expression  of  these  plans  as  work  plans  in  operational  terms  at 
the  supervisory  and  project  management  levels. 

Interfacing  the  formal  ADP  plans  with  other  organizational 
activities  and  planning  and  reporting  systems  is  necessary  for 
coordinating  and  integrating  systems  design  and  development 
activities  within  the  agency.  The  formal  planning  system  also 
should  provide  for  reviews  and  upcates  annually  and  at  major 
milestones  to  help  top  management  maintain  control  of  systems 
activities. 

Project  plans  and  supporting  budgets  must  have  specific 
measurable  accomplishments  and  should  be  stated  in  responsibility- 
related  tasks,  phases,  and  stages  with  quantitative  detail  es¬ 
sential  to  the  responsible  supervisory  personnel  and  project 
managers.  To  be  useful  in  the  measurement,  identification,  and 
comparison  of  actual  to  planned  resource  consumption  and  cost, 
the  task,  phase,  and  stage  classifications  of  the  plans  should  be 
consistent  with  the  management  reporting  system. 

CONGRESSIONAL  COMMITTEES,  OMB,  AND 
USDA  AGREE;  EFFECTIVE  MANAGEMENT 
OF  RESOURCES  REQUIRES  A 
COMPREHENSIVE  ADP  PLAN 

For  more  than  10  years  congressional  committees  have 
expressed  concern  over  the  lack  of  comprehensive  long-range 
plans  at  Federal  agencies  in  the  area  of  information  and  data 
processing.  For  example,  in  October  1976  the  House  Committee 
on  Government  Operations  reported  that  the  failure  of  Federal 
agencies  to  prepare  effective  long-range  plans  was  a  major  hin¬ 
drance  to  achieving  economical  procurements,  a  major  objective  of 
the  Brooks  Act  (Public  Law  89-306). 

The  importance  of  planning  is  emphasized  in  Office  of  Manage¬ 
ment  and  Budget  Circular  A-71.  This  circular  assigns  to  the  heads 
of  Federal  agencies  the  authority  and  the  responsibility  for  the 
effective  and  efficient  management  of  their  ADP  activities,  includ' 
ing  planning,  coordination,  and  control  of  the  use  of  these  re¬ 
sources  (for  example,  equipment,  software,  and  personnel).  The 
policy  calls  for  the  merger  and  integration  of  data  requirements, 
systems,  and  facilities,  irrespective  of  organizational  boundaries 
of  the  agency's  components,  when  greater  cost  effectiveness  in 
resource  utilization,  data  systems  management,  or  program  accom¬ 
plishment  can  be  achieved. 


For  more  than  10  years  USDA  has  recognized  the  need  for 
a  USDA-wide  comprehensive  ADP  planning  process.  From  time 
to  time  it  attempted  to  develop  an  effective  planning  process, 
but  its  efforts  fell  short  as  demonstrated  by  the  following 
chronology. 

— In  1970,  the  Secretary  of  Agriculture  approved  the 
concept  of  developing  an  overall  ADP  plan. 

— In  1971,  a  USDA  task  force  identified  actions  needed  to 
develop  the  overall  ADP  plan. 

— In  1975,  we  reported  to  the  Congress  USDA's  inefficient 
procurements  caused  by  poor  planning. 

— In  1976,  USDA  prepared  an  ADP  Management  Plan.  This 
planning  effort  was  discontinued  after  1977. 

— In  1977,  USDA  updated  the  1976  ADP  Management  Plan. 

This  plan  primarily  consisted  of  a  questionnaire  dis¬ 
tributed  to  senior  ADP  personnel  to  elicit  their 
thoughts  on  problems  and  the  direction  USDA  should  take 
in  managing  ADP  resources.  The  responses  reflected 
USDA's  need  for  long-range  ADP  planning. 

— In  1979,  the  Office  of  Operations  and  Finance  Task  Force 
assessed  USDA's  data  processing  requirements  for  1978 
through  1985.  The  report  recommended  formulating  an 
agency  and  departmental  5-year  ADP  plan.  The  task 
force  report  and  its  recommendations  were  accepted  by 
the  Assistant  Secretary  for  Administration. 

— In  1979,  USDA  prepared  a  draft  administrative  regulation 
on  the  planning  process.  The  draft  remained  dormant. 

— In  1980,  Data  Services  set  an  objective  to  develop  an 
ADP  planning  process.  However,  it  was  canceled  because 
other  matters  were  given  a  higher  priority.  According 
to  USDA  officials,  they  are  redefining  what  a  5-year 
ADP  plan  should  include. 

WHY  DOES  USDA  DELAY  IMPLEMENTING 
AN  ADP  PLANNING  PROCESS? 

USDA  and  its  agencies  continue  to  operate  without  a  compre¬ 
hensive  ADP  planning  process  long  after  the  need  for  such  a 
planning  process  was  recognized  by  the  Congress,  OMB,  us,  and 
USDA.  Why  does  USDA  permit  this  condition  to  persist? 

Several  factors  contribute  to  the  lack  of  a  comprehensive 
USDA  ADP  planning  process.  The  important  factors  follow. 
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— Neither  Data  Services  nor  the  agencies  have  placed 
a  high  priority  on  ADP  planning. 

— Data  Services  has  not  issued  guidelines  for  a  compre¬ 
hensive,  long-range  ADP  planning  process. 

— Data  Services  is  responsible  for  helping,  instead 
of  monitoring  or  directing,  the  agencies  in  any 
planning  or  budget  effort. 

— Data  Services  is  low  in  the  USDA  organizational 
hierarchy. 

— Data  Services  exercises  limited  central  control  because 
it  has  little  funding  authority  over  agencies. 

— Data  Services  has  experienced  high  management  turnover. 

Because  of  the  lack  of  central  direction,  agencies  deferred 
ADP  planning.  This  void  left  the  USDA  computer  centers  with  little 
basis  for  their  own  planning  efforts.  The  lack  of  Data  Services 
emphasis  on  the  importance  of  planning  was  demonstrated  by  agency 
ADP  officials'  comments.  For  example,  one  ADP  official  indicated 
the  central  office  did  not  communicate  the  "expectation"  that 
planning  should  be  performed.  Another  official,  whose  agency  was 
developing  a  plan,  felt  the  central  office  showed  little  interest 
and  made  unhelpful,  limited  comments  in  its  review. 

Early  in  1980  Data  Services  postponed  the  development  of  a 
planning  process  and  placed  higher  emphasis  on  other  ADP 
service  responsibilities  even  though  past  studies  repeatedly 
recommended  ADP  planning. 

Some  agencies  see  little  value  in  planning.  An  agency 
official  told  the  Department  that  the  agency  could  not  "guess" 
future  needs.  According  to  another  ADP  manager,  it  is  impossible 
to  make  long-range  plans  since  congressional  actions  or  economic 
conditions,  such  as  the  unemployment  rate,  cannot  be  predicted. 
Furthermore,  some  agency  officials  stated  simply  that  there  is 
no  need  for  the  Department  to  coordinate  agency  long-range  plans 
because  of  diverse  agency  needs. 

Effective  ADP  planning  is  dependent  on  how  a  department 
organizes  to  accomplish  the  planning  function.  Data  Services 
is  low  in  the  USDA  organizational  hierarchy.  It  is  important 
in  a  decentralized  organization  that  a  strong  central  office 
be  established  to  accomplish  USDA-wide  planning.  The  role, 
function,  and  structure  of  USDA’s  central  ADP  management  office 
are  covered  more  completely  in  chapter  2. 

High  turnover  in  management  also  contributed  to  the  delay  of 
planning  efforts.  There  were  four  Deputy  Directors  of  Data  Serv¬ 
ices  within  a  4-year  period.  Each  director  approached  planning 
somewhat  differently.  Data  Services  and  agency  officials  felt 
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that  the  frequently  changing  leadership,  with  varying  emphasis 
on  planning,  contributed  to  the  lack  of  progress. 


PLANNING  EFFORTS  AT  USDA 
AND  SELECTED  AGENCIES 

Data  Services  has  no  structured  framework  for  a  comprehensive 
ADP  planning  process  nor  has  it  issued  any  procedures  or  guidance 
to  establish  such  a  process.  Existing  USDA  planning  activities 
are  fragmented  and  essentially  short  term.  These  activities  are 
not  considered  useful  by  7  of  11  agency  ADP  officials  that  we 
contacted . 

Departmental  planning  activities 

USDA  viewed  its  ADP  planning  function  as  involving  the 
following  activities. 

— Planning  is  keyed  to  the  OMB  Circular  A-ll  ADP  budget, 
including  explanatory  notes.  1/ 

— Data  Services  works  with  individual  agencies  to  find 

solutions  to  known  agency  requirements  outside  the  budget 
process.  An  example  might  involve  an  agency  request  for 
minicomputers . 

— Information  is  exchanged  through  such  means  as  the 
Resource  Exchange  Program  and  the  annual  ADP  Managers 
Conference . 

Most  agency  ADP  officials  that  we  contacted  recognized  that 
the  above  activities  do  not  serve  as  a  useful  long-range  plan¬ 
ning  process.  They  felt  that  the  A-ll  budget  is  not  an  adequate 
ADP  plan  for  managers;  A-ll  ADP  budget  instructions  are  unclear 
and  frequently  misunderstood;  and,  furthermore,  the  budget  does 
not  relate  ADP  costs  back  to  agency  programs. 

The  budget  process  is  an  important  element  in  the  implemen¬ 
tation  and  feedback  portion  of  the  planning  process.  Through  its 
goals  and  objectives  the  budget  represents  a  short-term  plan  of 
action;  however,  successful  comprehensive  planning  requires  a 
more  complete,  long-range  perspective  and  a  more  thorough  feed¬ 
back  process  than  an  annual  budget  can  provide.  The  ADP  budget 
is  not  a  surrogate  for  planning;  rather,  it  is  a  part  of  the 
planning  process. 


1/OMB  Circular  No.  A-ll,  "Preparation  and  Submission  of  Budget 
Estimates,"  includes  instructions  to  the  heads  of  executive 
departments  and  establishments  relating  to  the  preparation  of 
annual  budgets.  Section  43  of  the  circular  requires  that 
data  be  submitted  on  the  acquisition,  operation,  or  use  of  ADP 
and  telecommunications  systems. 
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Most  managers  acknowledged  that  Resource  Exchange  Program 
meetings  and  the  annual  ADP  Managers  Conference  are  useful  for 
exchanging  information  but  were  not  intended  to  project  or 
establish  long-range  requirements. 

Planning  activities  at  selected  agencies 

USDA  agencies  are  not  preparing  comprehensive,  long-range 
ADP  plans  except  for  one  smaller  agency — the  Foreign  Agricultural 
Service — which  told  us  that  it  uses  such  a  planning  process.  The 
Forest  Service  has  also  been  taking  steps  to  develop  an  ADP  plan¬ 
ning  process.  Planning  activities  carried  out  by  four  USDA  agen¬ 
cies  are  discussed  below. 

FmHA  needs  effective, 

long-range  ADP  planning 

FmHA  has  not  implemented  an  effective,  comprehensive,  long- 
range  ADP  planning  process.  We  believe  the  absence  of  this  proc¬ 
ess  contributed  significantly  to  the  serious  problems  FmHA  has 
experienced  in  developing  its  Uniform  Management  Information  Sys¬ 
tem.  For  further  discussion  of  these  problems  see  chapter  3. 

FmHA  is  evaluating  various  alternatives  to  developing  an 
automated  accounting  and  information  system.  Before  it  pursues 
any  alternative,  FmHA  needs  to  implement  a  comprehensive,  long- 
range  ADP  planning  process  that  identifies  its  long-range  goals, 
objectives,  and  priorities.  This  is  essential  to  ensure  that 
the  alternative  selected  is  consistent  with  FmHA ' s  long-range 
mission  needs. 

NFC  planning  deficiencies 

NFC'S  ineffective  long-range  software  planning  efforts 
described  in  chapter  3  have  led  to  unrealistic  commitments,  less 
effective  project  management,  and  limited  hardware  planning. 

While  improvements  were  recently  brought  about  by  greater  empha¬ 
sis  on  planning,  a  systematic  approach  is  needed  to  assure  that 
benefits  are  realized. 

Earlier  NFC  plans  were  of  little  value  to  decisionmakers 
because  of  the  limited  information  they  provided.  The  respon¬ 
sibility  for  preparing  these  documents  had  not  been  consistently 
assigned  to  any  one  organization  or  individual.  These  documents 
generally  showed  only  the  estimated  completion  dates,  lacking 
resource  estimates  or  any  mention  of  relative  priorities. 

For  example,  a  May  1979  plan  indicated  that  during  that  fiscal 
year,  the  same  programing  staff  would  have  to  perform  maintenance, 
which  reportedly  accounted  for  more  than  half  of  their  time,  and 
complete  several  major  software  projects.  As  shown  in  chapter  3, 
at  least  some  of  these  projects  suffered  slippages  which  can  be 
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partially  attributed  to  overcommitted  staff.  Comprehensive  plan¬ 
ning  would  have  required  setting  project  priorities  and  commit¬ 
ting  available  resources  only  to  those  projects  which  could  rea¬ 
sonably  be  accomplished. 

Complying  with  a  fiscal  year  1980  O&F  requirement,  NFC 
began  preparing  a  5-year  plan  showing  software  projects,  ongoing 
activities,  and  estimated  staff-year  requirements.  However,  we 
found  similar  deficiencies  which  reduce  the  plan's  value  to  deci¬ 
sionmakers  and  external  planners.  For  example: 

— The  completion  dates  for  certain  software  projects  differ 
sharply  with  dates  shown  in  important  concurrent  documents 
prepared  for  other  purposes. 

— Priorities  are  not  shown. 

— Staff-year  estimates  shown  in  the  5-year  plan  are  gener¬ 
ally  undocumented,  questioned  by  responsible  officials, 
and/or  confused  by  the  arbitrary  assignment  of  overhead. 

Hardware  planning  efforts  were  limited  to  what  was  necessary 
for  budgeting  and  developing  procurement  documents.  NFC  has  made 
no  documented,  systematic  attempt  to  forecast  long-range  ADP 
equipment  needs,  based  on  current  software  plans.  We  were  told 
that  prior  procurement  studies  prepared  in  1977  containing  work¬ 
load  analysis  had  satisfied  this  need.  However,  such  documenta¬ 
tion  is  outdated  considering  NFC's  changing  development  plans 
and  slippages  in  software  projects.  NFC  needs  a  coordinated 
program  to  periodically  assess  its  future  hardware  needs  based 
on  a  documented,  up-to-date,  long-range  software  plan  with 
established  priorities  and  target  dates. 

Forest  Service  ADP  planning  efforts 

The  Forest  Service  has  recognized  the  need  for  an  effective, 
comprehensive,  long-range  ADP  planning  process  and  has  taken 
positive  steps  to  bring  it  about.  An  important  Forest  Service 
planning  effort  was  the  Systems  Development  Action  Planning 
Team  Report,  published  in  December  1975.  The  report  cited  three 
major  problems  regarding  the  use  of  ADP  to  achieve  agency  goals. 
These  problems  were  (1)  lack  of  a  framework  for  developing  and 
managing  systems,  (2)  lack  of  organizational  capability  to  handle 
changing  job  demands  and  technology,  and  (3)  lack  of  dynamic 
implementation  of  a  management  information  system. 

The  report  made  several  recommendations  to  solve  these  prob¬ 
lems.  Two  significant  recommendations  were  to  adopt  a  policy 
of  distributed  computing  and  to  restructure  the  Washington 
office.  The  restructuring  dealt  with  strengthening  the  agency's 
systems  management  by  organizing  to  reflect  three  groupings 
of  systems  activities  (data  management,  computer  technology, 
and  computer  applications),  by  establishing  systems  coordinators 
in  the  major  program  areas,  and  by  forming  a  systems  coordinating 
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council.  Forest  Service  has  accomplished  the  restructuring 
of  its  ADP  organization,  but  it  is  still  working  on  establish¬ 
ing  a  distributed  processing  network. 

In  mid-1979  the  Forest  Service  established  the  Systems 
Planning  Office  to  define  and  implement  a  national  strategic 
planning  process.  in  February  1980  the  Systems  Planning  Office 
published  the  National  Systems  Management  Plan  to  guide  the 
Forest  Service's  systems  management  efforts.  The  Forest 
Service  also  contracted  for  planning  studies  in  September  1979 
to  (1)  survey  external  systems  management,  (2)  examine  systems 
staff  and  Forest  Service  management  planning  requirements, 

(3)  analyze  strategic  planning,  (4)  analyze  planning  systems 
approaches,  and  (5)  develop  procedures  and  guidelines  for  a 
Forest  Service  system  planning  process. 

The  Forest  Service  has  begun  to  develop  long-range  ADP 
plans.  The  Chief  of  the  Forest  Service  has  directed  that 
each  region,  area,  and  station  develop  a  unit  systems  management 
plan  and  a  unit  facilities  plan.  The  management  plan  will  pro¬ 
vide  an  estimate  of  processing  needs  to  support  future  programs. 

The  facilities  plan  is  a  5-year  plan  which  states  specific  meth¬ 
ods,  especially  procurements,  for  meeting  ADP  objectives. 

ASCS  needs  a  comprehensive, 

long-range  ADP  planning  process 

Although  ASCS  has  not  developed  a  comprehensive,  long-range 
ADP  planning  process,  it  recognizes  that  such  a  process  could  be 
useful.  At  the  time  of  our  review,  ASCS  was  in  the  process  of 
developing  a  long-range  ADP  plan  for  the  Management  Field  Office 
in  Kansas  City,  Missouri.  This  effort  will  not  produce  a  com¬ 
prehensive,  long-range  plan  because  other  ASCS  organizational  units 
involved  in  ADP  are  excluded.  Examples  are  the  Kansas  City  Com¬ 
modity  Office  and  the  Aerial  Photography  Field  Office.  However, 
since  the  Field  Office  is  ASCS'  largest  ADP  user,  ASCS'  plan,  if 
properly  developed,  will  be  a  significant  start. 

The  Policy  and  Planning  Staff,  located  at  the  ASCS  Management 
Field  Office,  is  responsible  for  planning  for  automation  of  ASCS 
programs,  including  developing  agency  ADP  objectives,  conducting 
feasibility  studies,  monitoring  and  evaluating,  and  making  impact 
appraisals.  The  staff  translates  ASCS  user  needs  into  ADP  equip¬ 
ment,  communications,  and  data  management  requirements. 

The  staff  has  not  developed  any  formalized  long-range  ADP 
planning  outside  the  OMB  Circular  A-ll  budget  process.  The 
budget  process  addresses  only  the  next  2  fiscal  years,  except 
that  major  computer/telecommunication  acquisition  plans  and 
staffing  requirements  are  projected  in  dollars  for  5  years. 

Although  this  process  is  of  some  value,  ASCS  officials  gener¬ 
ally  agreed  that  their  agency  needs  more  specific,  comprehensive, 
long-range  plans  that  reflect  long-term  ADP  goals,  objectives, 
and  priorities. 
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CONCLUSIONS 


USDA  and  its  agencies  need  a  comprehensive  planning 
process  to  manage  their  ADP  and  other  information  resources  more 
effectively.  As  we  discussed  in  chapter  2,  to  effectively  imple¬ 
ment  the  Paperwork  Reduction  Act,  USDA  will  have  to  develop  a 
comprehensive  planning  process  that  includes  not  only  ADP  but 
other  information  management  activities. 

Because  of  poor  planning,  USDA  frequently  uses  inefficient 
and  outdated  ADP  systems  in  managing  multibill ion-dollar  assets 
and  in  carrying  out  its  programs.  Although  the  impact  of  using 
inefficient  ADP  systems  is  not  measured,  we  identified  millions 
of  dollars  in  cost  overruns  for  system  implementation  and  delays 
in  converting  ADP  systems  to  modern  equipment. 

Congressional  committees,  OMB,  and  USDA  agree  that  effective 
management  of  Department  and  agency  ADP  resources  requires  a 
comprehensive  ADP  planning  process.  Although  they  have  initiated 
some  actions  to  develop  an  acceptable  planning  process,  we  believe 
that  USDA  and  its  agencies  have  not  placed  sufficient  emphasis  on 
developing  this  process. 

t 

RECOMMENDATIONS  TO  THE 
SECRETARY  OF  AGRICULTURE 

We  recommend  that  the  Secretary  of  Agriculture  direct  the 
senior  official  designated  under  the  Paperwork  Reduction 
Act  to 

— develop  USDA-wide  guidelines  for  a  comprehensive 
IRM  planning  process  and 

— direct  the  agencies  to  adapt  their  planning  processes 
to  guidelines  developed  by  the  senior  official. 
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CHAPTER  7 


OBJECTIVE,  SCOPE ,  AND  METHODOLOGY 

The  objective  of  our  review  was  to  evaluate  the  effective¬ 
ness  of  the  Department's  central  ADP  management  structure  in 
supporting  USDA's  mission  and  programs.  We  accomplished 
this  objective  by  evaluating  how  USDA's  central  management 
structure  ensured  that  major  ADP  management  functions  such  as 
the  following  were  adequately  performed  by  USDA  agencies: 

1.  Planning  and  forecasting  requirements. 

2.  Measuring  and  evaluating  performance. 

3.  Procuring  computer  equipment. 

4.  Providing  satisfactory  service  to  ADP  users. 

5.  Protecting  facilities  and  data  (security). 

6.  Managing  and  developing  software. 

Because  the  chairman's  request  granted  us  broad  leeway 
in  carrying  out  the  review,  we  obtained  concurrence  from  his 
office  that  the  above  audit  approach  would  be  responsive  to 
the  needs  of  the  committee.  Our  field  work  was  carried  out 
during  calendar  year  1980  and  generally  covered  conditions 
existing  in  USDA  during  that  period  although  we  did  analyze 
ADP  developments  occurring  in  USDA  during  the  1970s. 

Near  the  completion  of  our  audit  work,  the  Congress  enacted 
the  Paperwork  Reduction  Act  of  1980.  Because  the  act  has  a 
direct  impact  on  how  an  agency  manages  its  ADP  and  other  infor¬ 
mation  resources,  we  evaluated  how  the  act  should  be  implemented 
in  USDA.  Although  our  work  was  primarily  directed  at  USDA's  ADP 
management,  we  did  review  our  past  reports  dealing  with  other 
information  management  issues  at  USDA,  such  as  records  management 
and  paperwork  management.  These  reports  are  discussed  in  chapter 
2. 


As  criteria  in  judging  how  well  the  above  functions  were 
being  carried  out,  we  took  the  position  that  the  management  prin¬ 
ciples  and  practices  applicable  to  non-ADP  activities,  programs, 
and  functions  are  applicable  in  the  main  to  ADP  activities.  For 
example,  just  as  planning,  control,  direction,  and  accountability 
are  critical  to  effectively  managing  a  Government  program,  we 
believe  they  are  also  critical  to  effectively  managing  ADP  re¬ 
sources  and  activities. 

Since  ADP  management  at  USDA  is  shared  between  the  agencies 
and  the  Department's  central  ADP  office  in  Washington,  D.C., 
our  review  included  work  at  both  the  agencies  and  the  central 
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office.  Also,  since  the  central  office  is  responsible  for  pro¬ 
viding  policy  direction  and  operating  USDA's  computer  centers, 
we  examined  both  of  these  responsibilities. 

We  selected  four  USDA  agencies  for  detailed  review:  the 
Farmers  Home  Administration,  the  Forest  Service,  the  Agricul¬ 
tural  Stabilization  and  Conservation  Service,  and  the  National 
Finance  Center.  Because  FmHA  was  recently  the  subject  of  a 
thorough  examination  by  us  1/  and  by  the  House  Government 
Operations  Committee  2/  regarding  FmHA ' s  management  of  its 
computer-based  UMIS  project,  we  did  not  feel  additional  audit 
work  at  FmHA  was  necessary;  however,  we  have  considered  the 
results  of  these  reviews  in  evaluating  USDA  management. 

Through  discussions  with  USDA  officials,  we  have  kept  abreast 
of  the  status  of  the  UMIS  project. 

These  agencies  were  selected  because  they  are  four  of 
USDA's  largest  ADP  users  and  because  they  represent  various 
management  structures,  from  highly  centralized  to  highly 
decentralized.  The  Forest  Service  delegates  responsibility 
and  authority  to  the  lowest  feasible  level  of  its  organization, 
which  is  scattered  throughout  the  country;  while  at  NFC,  locat¬ 
ed  in  one  building  in  New  Orleans,  management  is  centralized 
and  the  Director  provides  close  supervision  to  lower  management 
levels.  FmHA  and  ASCS  are  similar  in  that  each  has  a  head¬ 
quarters  unit  providing  policy  and  direction,  a  major  field 
unit  providing  much  of  the  operational  management,  and  about 
2,000  State  and  county  offices  serving  its  constituency. 

We  also  performed  an  evaluation  at  the  three  USDA  computer 
centers  operated  by  Data  Services  and  located  in  Washington,  D.C.; 
Fort  Collins,  Colorado;  and  Kansas  City,  Missouri.  These  three 
computer  centers  provide  ADP  support  for  all  USDA  agencies. 

In  addition,  we  evaluated  the  computer  center  at  NFC,  which  had 
been  operated  by  the  central  ADP  office  until  1977  when  it  was 
merged  with  NFC.  We  did  not  visit  the  St.  Louis  Computer  Center 
in  this  review.  However,  we  did  visit  it  during  our  review  of 
FmHA's  UMIS  project. 

We  also  considered  and  relied  upon  information  contained  in 
our  and  OIG  audit  reports  published  during  the  last  several  years 
that  discuss  ADP  management  issues  at  USDA.  Besides  briefings 
and  informal  reports,  we  identified  a  briefing  to  congressional 


^/"Farmers  Home  Administration's  ADP  Development  Project — 
Current  Status  and  Unresolved  Problems"  (CED-80-67,  Feb. 
19,  1980). 

^/"Management  Failures  in  Developing  the  Farmers  Home 

Administration's  Unified  Management  Information  System," 
House  Report  No.  96-1408,  Sept.  26,  1980. 


82 


staff,  11  of  our  reports,  and  6  OIG  reports  that  were  pertinent 
to  our  review.  These  reports  and  the  briefing  are  listed  along 
with  summaries  in  appendixes  I  and  II.  Generally,  as  part  of 
this  review,  we  did  not  determine  whether  the  recommendations 
in  our  past  reports  had  been  implemented  because  the  recommen¬ 
dations  were  directed  at  correcting  problems  with  specific 
projects  and  procurements.  Instead,  we  analyzed  these  reports 
to  determine  long-standing  management  problems  that  remained 
unresolved  and  then  sought  to  relate  these  problems  to  weak¬ 
nesses  in  the  ADP  management  structure.  Our  intention  was  to 
look  for  ways  to  treat  the  basic  causes  of  USDA's  continuing  ADP 
def ic ienc ies . 

During  our  review  we  also 

— examined  USDA's  implementation  of  policies,  procedures, 
standards,  and  guidelines  established  internally  and  ex¬ 
ternally  by  the  Office  of  Management  and  Budget,  the 
General  Services  Administration,  the  National  Bureau 
of  Standards,  and  by  us  which  relate  to  managing  and 
procuring  computer  resources; 

— conducted  random  tests  of  NFC  security  procedures; 

— analyzed  plans,  studies,  and  other  documents  relating  to 
USDA  computer  resources  management; 

— interviewed  three  former  officials  of  USDA's  central  ADP 
office ; 

— interviewed  ADP  managers  at  11  USDA  agencies; 

—  interviewed  the  head  of  USDA's  central  ADP  management 
office  and  the  heads  of  his  four  divisions; 

— obtained  background  information  on  USDA's  computer 
centers  by  having  each  center  complete  answers  to  a 
standard  list  of  questions  called  a  "computer  instal¬ 
lation  profile";  and 

— obtained  written  answers  from  USDA's  Assistant  Secre¬ 
tary  for  Administration  to  our  questions  on  ADP  manage¬ 
ment  functions  dealing  with  planning,  organization,  and 
control . 

Generally  USDA  and  the  agencies  we  reviewed  did  not  have 
good  data  on  total  software  costs  and  costs  to  develop,  operate, 
and  convert  individual  applications  software  systems.  Therefore, 
we  had  to  develop  estimates  of  these  costs.  Explanations  of  our 
methodology  in  developing  these  estimates  are  included  in  chapter 
3. 
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SUMMARY  OF  OUR  REPORTS  ON 
US DA  ADP  MANAGEMENT 
1975-80 


Report  number,  date, 
and  title 


1.  LCD-75-108 

(June  3,  1975) 
"Improved  Planning-- 
A  Must  Before  a 
Department-wide 
Automatic  Data 
Processing 
System  Is  Acquired 
for  the  Department 
of  Agriculture" 


We  reviewed  a  proposed  USDA  procure¬ 
ment  to  obtain  equipment  for  four 
USDA  computer  centers.  For  the  four 
centers,  the  total  cost  of  the  project, 
including  equipment,  software,  tele¬ 
communications,  and  operating  costs 
over  an  8-year  period,  was  estimated 
by  us  at  $398  million.  We  found  that 
USDA  had  not  made  the  detailed  plans 
or  studies  that  should  have  preceded 
procurement.  Specifically,  USDA  did 
not  (1)  adequately  analyze  user 
requirements,  (2)  adequately  consider 
security  requirements  to  protect 
sensitive  information,  and  (3)  make 
economic  studies  to  evaluate  the 
project's  benefits  and  the  costs  of 
alternative  designs.  We  recommended 
that  the  proposed  procurement  be  can¬ 
celed  and  analyses  be  made  to  select 
the  best  alternative  for  meeting  USDA 
requirements. 


2.  LCD-76-120  We  found  that  the  Washington  Computer 

(Apr.  16,  1976)  Center  had  not  made  a  study  to  justify 

Letter  report  on  the  need  to  convert  from  single-density 

proposed  procurement  disk  drives  to  double-density  disk 

of  disk  drives  by  drives  or  the  need  for  a  mass  storage 

USDA's  Washington  system  capable  of  housing  larger  data 

Computer  Center  bases.  We  also  noted  that  although 

the  center  had  been  using  one  vendor's 
disk  drives,  these  were  also  available 
from  another  vendor  at  substantially 
less  cost  (about  $339,000  annually). 
USDA  accepted  our  recommendations 
to  cancel  the  procurement  request  for 
double-density  disk  drives  and  order 
the  single-density  disk  drives  from 
the  vendor  offering  lower  prices. 
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Report  number,  date, 
and  title 

3.  LCD-77-101 

(Dec.  1,  1976) 

Letter  report  on  GAO 
review  of  USDA  plans 
to  replace  a  computer 
system  at  its  New 
Orleans  Computer 
Center 


4.  LCD-76-126 

(Dec.  30,  1976) 
"New  Computer  Was 
Not  Needed  for 
the  St.  Louis 
Computer  Center" 


5.  LCD-77-115 

(June  20,  1977) 
Letter  report  on 
GAO  evaluation  of 
allegation  by 
USDA's  Washington 
Computer  Center 
that  low-pr iced 
disk  drives  were 
degrading  service 


Summary 

We  reviewed  USDA's  plans  to  upgrade  a 
computer  system  on  an  interim  sole- 
source  basis  at  its  New  Orleans  Com¬ 
puter  Center  .  Our  review  showed 
that  forecasted  shortages  in  the  com¬ 
puter's  capacity  were  not  material¬ 
izing  because  of  modifications  and 
enhancements  made  to  the  system.  We 
concluded  that  there  was  no  immediate 
need  to  acquire  an  upgraded  system. 

USDA  agreed  with  us,  suspended  the 
interim  acquisition,  and  proceeded 
to  plan  for  a  competitive  acquisition. 

We  found  that  procurement  of  a 
replacement  computer  system  for  the 
St.  Louis  Computer  Center  was  not 
justified  because  (1)  the  existing 
computer  had  sufficient  capacity,  (2) 
projected  workload  increases  were 
overstated,  and  (3)  improved  use  of 
computer  resources  would  have  enabled 
the  center  to  operate  without  the  new 
computer  system  until  consolidating 
with  the  Kansas  City  Computer  Center 
and  implementing  a  new  management 
information  system  in  fiscal  year  1978. 
Furthermore,  we  stated  that  improve¬ 
ments  could  result  in  annual  savings 
of  over  $400,000. 

With  technical  assistance  from  the 
Federal  Computer  Performance 
Evaluation  and  Simulation  Center 
(FEDSIM),  we  reviewed  the  allegation 
of  USDA's  Washington  Computer  Center 
that  low-priced,  competitively 
acquired  disk  drives  were  causing 
degradation  of  service.  FEDSIM  con¬ 
cluded  that  USDA's  allegations  were 
based  on  a  study  which  used  inappro¬ 
priate  statistical  methods. 
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Repot t  number,  date, 
and  title 


Summary 


6. 


LCD-77-114 
(June  23,  1977) 

Letter  report  dealing 
with  teleprocessing 
requirements  for 
FmHA's  Unified 
Management  Information 
System 


This  report  summarizes  our  involve¬ 
ment  to  date  with  certain  aspects  of 
FmHA's  system  development  project, 
the  Unified  Management  Information 
System.  Specifically,  FmHA  decided 
to  proceed  with  UMIS  without  the 
on-line  terminal  network  that 
would  have  included  terminals  in 
every  county  office  and  agreed  to 
accept  certain  safeguards,  suggested 
by  the  Chairman  of  the  House  Govern¬ 
ment  Operations  Committee,  that  would 
help  ensure  the  successful  development 
of  UMIS. 


7.  LCD-77-104 

(July  1,  1977) 

Letter  report  on  GAO 
review  of  a  sole- 
source  procurement 
by  USDA's  Fort 
Collins  Computer 
Center 


8.  LCD-77-118 

(Dec.  23,  1977) 
"Cooperative  Actions 
Result  in  More 
Economical  Computer 
Acquisition  and 
Improved  Security 
at  the  New  Orleans 
Computer  Center" 


In  July  1976  USDA  acquired  a  central 
processing  unit  on  a  sole-source 
basis  to  replace  a  smaller  system  at 
its  Fort  Collins  Computer  Center.  We 
concluded  that  better  planning  would 
have  allowed  the  center  to  operate  with 
the  smaller  system  until  a  competitive 
procurement  could  have  been  completed. 
We  found  that  the  Forest  Service  was 
transferring  its  data  processing  work¬ 
load  to  the  center  without  regard  to 
the  capacity  of  the  smaller  system  and 
without  cost  analyses  to  determine  what 
part  of  its  workload  could  be  most 
economically  transferred.  USDA  agreed 
with  the  facts  presented  in  the  report. 

We  found  that  USDA  was  remiss  in  not 
following  prescribed  procedures  for 
acquiring  a  computer  system  which  was 
needed  at  its  New  Orleans  Computer  Cen¬ 
ter.  However,  the  agency's  cooperation 
with  us  enabled  the  acquisition  to  pro¬ 
ceed  with  resultant  savings  to  the 
Government  of  about  $7.5  million.  The 
cooperation  also  helped  to  establish 
a  new  software  conversion  method.  In 
addition,  USDA  began  to  correct  secur¬ 
ity  deficiencies  noted  in  our  review. 

We  recommended  that  the  center's  secur¬ 
ity  program  be  reevaluated  to  ensure 
that  the  controls  needed  to  safeguard 
personal  data  and  financial  operations 
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Report  number,  date, 
and  title 


9.  CED-78-68 

(Feb.  27,  1978) 
"Farmers  Home  Admin¬ 
istration  Needs  To 
Better  Plan,  Direct, 
Develop,  and  Control 
Its  Computer-Based 
Unified  Management 
Information  System" 


10.  (Oct.  12,  1979) 

GAO  briefing  to 
staff  of  House 
Government  Operations 
Committee  dealing 
with  ADP  management 
issues  at  USDA's 
National  Finance 
Center  (no  formal 
written  report 
was  requested) 


Summary 

are  planned  for  use  when  the  system 
becomes  fully  operational. 

The  Unified  Management  Information 
System  is  a  computer-based  information 
system  under  development  by  the 
Farmers  Home  Administration.  This  new 
system  is  designed  to  deliver  better 
management  information  to  all  offices 
and  levels  within  the  agency.  It  is 
also  intended  to  improve  service  to 
rural  Americans  seeking  financial 
assistance.  Our  recommendations  made 
in  this  report  were  intended  to  help 
the  agency  more  effectively 

— schedule  resources  and 
completion  dates, 

— monitor  life-cycle  costs  for 
developing  and  operating  the 
system, 

— plan  and  develop  the  system 
consistent  with  user  needs, 

— develop  test  plans  for  the 
two  system  alternatives, 

— evaluate  the  impact  of  organ¬ 
izational  changes  on  the 
system,  and 

— exercise  top  management 
control . 

In  response  to  the  committee's 
request,  we  conducted  a  review  of 
two  major  management  issues  at  NFC. 

The  issues  focused  on  the  consequences 
of  not  completing  (1)  the  redesign  of 
USDA's  computerized  payroll  system 
and  (2)  the  conversion  of  USDA's  com¬ 
puterized  application  software.  We 
presented  the  following  consequences 
which  resulted  from  USDA's  management 
deficiencies  associated  with  missed 
completion  dates  of  critical  ADP  proj¬ 
ects:  (1)  additional  costs  to  retain 

old  computers,  (2)  costs  to  acquire 
additional  computer  equipment  or 
capacity,  and  (3)  delayed  benefits 
to  users.  We  concurred  with  NFC's 
plans  to  acquire  an  old  computer  at 
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Repoi t  number  ,  date, 

and  title  Summar  y 

minimal  cost  for  backup  during  the 
redesign  period  instead  of  a  more 
capacious  computer.  Subsequently, 
NFC  procured  the  old  computer . 


11.  CED-80— 6 7  In  1974  the  Farmers  Home  Administration 

(Feb.  19,  1980)  began  developing  a  new  computer-based 

"Farmers  Home  Admin-  information  system.  In  this  report, 
istration's  ADP  we  disclosed  that  the  Unified  Manage- 

Development  Project —  ment  Information  System  project 
Current  Status  and  was  suffering  from  poor  planning  and 

Unresolved  Problems"  management.  It  was  at  least  5  years 

behind  schedule,  and  the  development 
cost  for  UMIS  or  its  alternative  may 
reach  $42  million.  Furthermore,  the 
cost  to  operate  the  system,  as 
designed,  may  prove  to  be  excessive, 
and  it  may  not  meet  the  basic  needs 
it  was  intended  to  fulfill.  We  con¬ 
cluded  that  UMIS,  as  currently 
designed,  was  no  longer  a  viable 
appr oach  to  meeting  FmHA's  information 
needs.  The  agency  was  studying  alter¬ 
natives  to  the  system.  We  recommended 
that  before  making  a  final  decision, 
the  agency  should  first  determine  its 
information  needs.  We  also  recommended 
that  in  developing  a  new  system,  the 
agency  improve  its  project  management 
and  increase  the  level  of  involvement 
by  top  management. 


12.  CED-81— 15 

(Oct.  23,  1980) 
"Forest  Service's 
Region  5  Should 
Consider  Less 
Costly  Ways  To 
Meet  Word  and 
Data  Processing 
Needs" 


In  1979  the  Forest  Service’s  region  5 
leased  advanced  word-processing  equip¬ 
ment  with  commun ications  and  data  proc¬ 
essing  capabilities.  Although  the 
region  was  benefiting  from  the  equip¬ 
ment,  we  found  the  procurement  to  be 
unnecessarily  costly.  The  Forest 
Service  agreed  with  our  recommendations 
that  the  region  conduct  (1)  a  review 
to  measure  the  equipment's  cost  effec¬ 
tiveness  and  (2)  an  economic  analysis  of 
ways  to  meet  the  region’s  requirements 
but  at  a  lower  cost. 
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SUMMARY  OF  MAJOR  OIG  REPORTS  ON 
USDA  ADP  MANAGEMENT 
1975-81 


Report  number,  date, 
and  title 


Summary 


1.  System  Development 
Advisory  Memorandums 
on  FmHA's  UMIS 
project 
(May  1976  to 
June  1978) 


USDA's  OIG  has  provided  in-depth  reviews 
of  the  entire  UMIS  effort  from  its  in¬ 
ception  in  1975.  From  May  1976  to  June 
1978  the  OIG  issued  24  system  develop¬ 
ment  advisory  memorandums  intended  as 
informal  reports  on  UMIS  problems  for 
FmHA  management  action. 


2.  Audit  Report 

No.  19602-1-Hy : 
(Dec.  19,  1977) 
"Audit  of  ADS, 
Office  of  the 
Assistant  Director 
for  Operations" 


This  report  covers  an  audit  of  the 
office  of  the  Assistant  Director  for 
Operations  within  the  Office  of 
Automated  Data  Systems  (ADS).  The 
report  noted  that  ADS  officials  believe 
they  do  not  have  authority  to  control 
development  of  agencies'  ADP  applica¬ 
tions,  which  would  affect  the  equipment 
efficiency  at  the  USDA  computer  centers. 
Therefore,  agencies  are  not  required  to 
use  available  tools  and  services  which 
would  increase  the  efficiency  of  their 
ADP  operations.  Only  two  of  nine 
agencies  contacted  had  used  available 
tools  and  services. 


The  ADS  Director  believed  his  office 
should  provide  ADP  standards,  guidelines 
and  instructions  to  agencies.  However, 
he  stated  that  it  was  an  internal  audit 
function  to  determine  whether  agencies 
implemented  and  complied  with  ADP  stand¬ 
ards,  guidelines,  and  instructions. 

The  report  stated  that  the  OIG  believes 
ADS  has  the  authority  to  require  all 
agencies  to  use  various  available  tools 
and  services. 


Regarding  ADP  procurement  planning,  the 
report  also  found  that  ADS  (1)  had  not 
developed  procedures  to  determine  whethe 
agency  workload  projections  were  reason¬ 
able  and  (2)  did  not  review  agency 
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ADP  applications  to  determine  whether 
they  were  compatible  with  USDA  computer 
center  equipment  and  were  cost  justified. 
ADS  accepted  workload  projections  and 
justification  at  face  value  because 
it  did  not  believe  that  it  had  the 
authority  to  question  these  matters. 


3.  Audit  Report 

No.  19605-1-Hy: 
(May  8,  1978) 
"Management  and 
Utilization  of 
Minicomputers 
in  USDA, 

Washington,  D.C." 


4.  Audit  report 
No.  50530-4-Hd: 
(Oct.  13,  1978) 
"Review  of  ADP 
Security  Procedures 
and  Controls: 
Washington  Computer 
Center  (WCC)  and 
User  Agencies" 


The  OIG  found  that  since  the  USDA 
central  ADP  office  did  not  have  formal¬ 
ized  procedures  for  reviewing  agencies' 
requests  for  technical  approval  to  pro¬ 
cure  minicomputers,  the  office  routinely 
granted  technical  approval  without 
assurance  that  the  requested  equipment 
was  viable  and  necessary.  In  one  agency, 
a  $287,000  minicomputer  system  was  pur¬ 
chased  even  though  the  agency  did  not 
submit  a  requirements  analysis  to  the 
central  ADP  office  depicting  the  size 
of  the  minicomputer  required.  Conse¬ 
quently,  the  central  processor  was  used 
only  26  percent  of  its  available  time 
and  most  of  the  peripheral  equipment 
costing  $89,000  was  not  in  use  at  the 
time  of  the  audit. 

The  OIG  inquiry  established  that  during 
a  1-year  period  (Apr.  1977-Mar.  1978) 
some  USDA  employees  made  about  5,700 
unauthorized  accesses  to  computer  files 
belonging  to  WCC,  23  user  agencies,  and 
two  outside  agencies.  During  this  same 
1-year  period,  employees  of  15  USDA 
user  agencies  made  about  700  unauthorized 
accesses  to  computer  files  used  solely  by 
WCC  to  manage  and  operate  its  computer 
system.  Although  no  evidence  of  large 
dollar  losses  was  found,  the  report 
stated  that  a  very  real  potential  exists 
for  large  dollar  losses,  damage  to 
agencies'  operations,  lawsuits,  and 
embarrassment  to  the  Department. 

The  inquiry  showed  that  most  of  USDA's 
ADP  security  weaknesses  resulted  from 
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(1)  a  general  lack  of  management  concern 
and  emphasis  on  computer  security,  (2) 
poor  computer  security  procedures  and 
practices  at  WCC  and  among  user  agencies 
and  (3)  WCC  and  user  agency  noncom¬ 
pliance  with  USDA's  existing  security 
standards  and  guidelines.  Further, 
there  was  no  central  management  organi¬ 
zation  with  day-to-day  responsibility 
and  authority  for  monitoring  and 
enforcing  USDA  computer  security  pro¬ 
cedures  and  standards  among  the  agencies 
The  report  concluded  that  top  management 
emphasis  on  the  seriousness  of  ADP 
security  is  needed. 


5.  Audit  report 
No.  50530-6-Hq: 

(Feb.  20,  1980) 
"Audit  of  a  Food  and 
Nutrition  Service 
( FNS )  Proposal  to 
Procure  External 
Data  Processing 
Services" 


The  report  concluded  that  FNS  did  not 
follow  USDA  procedures  when  working  up 
its  proposal  to  procure  external  data 
processing  services  at  an  estimated 
annual  cost  of  $175,000  to  support  the 
Child  Nutrition  Program  payment  systems 
and  program  accounting  system. 


6.  Audit  Report 

No.  50639-1-Hq : 
(Sept.  17,  1980) 
"Review  of  ADP 
Security  and 
Controls : 
Washington 
Computer  Center 
and  User  Agencies" 


The  objective  of  this  audit  was  to 
determine  the  adequacy  of  security  con¬ 
trols  provided  by  the  Washington 
Computer  Center  and  the  compliance 
of  its  20  USDA  user  agencies  with  such 
controls.  The  report  noted  that 
security  standards  and  procedures  had 
improved  since  the  last  OIG  audit  of 
WCC  in  1978.  There  was,  however,  a  need 
for  better  internal  controls  to  ensure 
that  new  security  procedures  were  under¬ 
stood  and  implemented  by  user  agencies. 

Also,  WCC  does  not  have  a  contingency 
plan  for  the  processing  of  user  agencies 
critical  systems  should  a  major  disrup¬ 
tion  occur  at  the  center;  disaster 
recovery  (backup)  tapes  containing 
critical  data  files  were  not  stored  in 
facilities  separate  from  the  main  tape 
library;  and  users'  ADP  equipment 
inventories  were  not  regularly  updated 
to  reflect  new  acquisitions,  transfers, 
and  dispositions. 
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7.  Audit  report 

No.  11608-2-Hq: 
(Jan.  13,  1981) 
"Management  and 
Security  Audit 
of  the  Fort 
Collins  Computer 
Center  and  User 
Agencies" 


The  primary  objective  of  this  audit  was 
to  determine  the  adequacy  of  security 
provided  by  the  FCCC  and  the  user 
agencies.  The  audit  found  that  user 
agencies  were  not  complying  with 
existing  ADP  security  standards  because 
agency  management  had  not  placed  a  high 
priority  on  ADP  security.  As  a  result, 
files  valued  at  approximately  $2.25 
million  and  files  covered  by  the  Privacy 
Act  of  1974  were  inadequately  protected. 
Also,  user  agencies  had  not  developed 
contingency  plans  to  identify  and  prior¬ 
itize  critical  application  programs  and 
data  files  in  case  of  a  major  disaster 
at  FCCC.  Although  user  agencies  have 
estimated  losses  exceeding  $1.2  billion 
in  case  of  a  major  disaster  at  FCCC,  the 
offsite  disaster  storage  facility  pro¬ 
vided  by  FCCC  was  not  being  used  to  full 
advantage  by  all  agencies.  Some  users 
responsible  for  backing  up  critical 
files  were  unaware  that  offsite  storage 
facilities  were  available  to  them. 

In  addition,  the  FCCC  ADP  security 
procedures  and  controls  were  not 
adequate  to  meet  the  standards  required 
by  the  Privacy  Act.  As  a  result,  user 
agencies  were  maintaining  Privacy 
Act  data  under  inadequate  security 
conditions,  unauthorized  users  were 
not  limited  in  their  attempts  to  access 
the  system,  and  system  access  keys 
were  not  adequately  protected. 


(061050) 
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